All Apps and Add-ons

loop to create new dashboard panels

codedtech
Path Finder

I have a list of 51 locations, and I want to create dashboard that displays the results of the query below in a separate panel for each site.

index= index cluster=""site=""| bin _time span=1d|eval time=(time)|eventstats sum(dscapacityGB) as capacity sum(dsfreeGB) as free sum(dsgarbageGB) as garbage sum(vmdkallocGB) as vmdkallocated sum(vmdkusedGB) as vmdkused by cluster, _time|eval allocated = round((capacity),2)|eval utilization= round(((vmdkused+garbage)-capacity),2)|chart sum(allocated) as allocated avg(capacity) as capacity by site|eval capacity=round(capacity,2)|eval allocated=round(allocated,2)

I could do this manually, but I wanted to know if there was a for loop that can do it for me.

jpolvino
Builder

I'm not aware of a loop feature, but when faced with this challenge, I've gone into the XML itself and copied the row blocks over and over.

  <row>
    <panel>
      <table>
        <title>Sunday</title>
        <search>
          <query>(your search)</query>
          <earliest>-6w@w</earliest>
          <latest>@w-1s</latest>
        </search>
        <format type="color" field="Duration">
          <colorPalette type="minMidMax" minColor="#FFFFFF" maxColor="#6A5C9E"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
      </table>
    </panel>
</row>

Then it's just a matter of find/replace.

You may want to consider grouping data into panels. Having 51 distinct panels may exceed the number of concurrent searches and perform slowly. Or have a drop-down to select the site. Yet another option is to have each one set up as a scheduled report, and then use those reports in the single big dashboard.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...