hiddenchart formatter module

[tmarlette]

Does the hidden chart formatter module have the ability to use a
fields' results as an axis name.

Say if I wanted to use something like the value of the 'counter' field for the y
axis title, can it do that?

I tried 'charting.chart.yaxis.field.counter' as a parameter, but it didn't take. I'm
assuming my syntax is wrong, and I couldn't find anything in the
documentation on it, so I figured I would ask.

Thank you!

[sideview · Accepted solution]

One problem is that HiddenChartFormatter is not a Sideview module, but a Splunk module.

The Splunk modules and their params, with only a couple exceptions, dont do $foo$ substitution and can't incorporate dynamic things from upstream.

However the Sideview ValueSetter module can completely replace the HiddenChartFormatter, and ValueSetter of course can do $foo$ substitution. So that's half the battle.

<param name="charting.chart.stackMode">

in HiddenChartFormatter becomes

<param name="arg.charting.chart.stackMode">

in ValueSetter

The other half of the battle is different though. Backing up, field values in search results do start to feel a lot like the $foo$ tokens in the Sideview views. They're different spaces of things though. The core docs page "introduction to the advanced XML" touches on this at the end.

(Re-read that page a few times and you will later feel it was time well spent). Specifically it says

"After you get used to $foo$ tokens, they start to feel a lot like the fields in
the Splunk search language. Just remember that these are two
completely different spaces of keys and values. Except for some
advanced stuff that the ResultsValueSetter module can do, these two
spaces of key value pairs do not mix."

So... The other half of our battle is won by the Sideview ResultsValueSetter module, which of course has its own docs pages. Anyway, it can turn the counter field, as it exists in the first row of some search result, into a $counter$ token, that can then be plugged into the Sideview ValueSetter module, which can then create the key the chart modules will look for. Putting it all together:

<module name="ResultsValueSetter">
  <param name="fields">counter</param>

  <module name="ValueSetter">
    <param name="arg.charting.axisTitleY.text">$counter$</param>
    ... your charting modules.
  </module>
</module>

and you have a y-axis title that is always the value of the "counter" field in whatever search results ResultsValueSetter was looking at.

[sideview]

For extra brainbending, you can also do this, which is fun but I think harder on the eyes and brains.

<module name="PostProcess">
  <param name="search">rename counter as "charting.axisTitleY.text"</param>
  <module name="ResultsValueSetter">
     <param name="fields">charting.axisTitleY.text</param>

It renames the field in the search language so when RVS creates the $foo$ token it already has the right name.

[tmarlette]

Nick, You're awesome bro. Thank you sir, this worked like a charm.