Can anyone post a complete dashboard example, with a dropdown populated by query1, and a pie charting counts based on the dropdown selection? I've been trying for 2 days now to build this - but in vain.
I did find examples, but they were all snippets, and in mixed versions.
I have both searches at hand, both provide correct timely results when performed manually.
1.
query1 is: policyinfo | transaction ip | stats values(policy)
2.
assuming the dropdown selection is in $policyname$, then
query2 is: status=Match policy="$policyname$" | transaction ip | stats count by rule
Thanks
rama
Hi ramabu,
take this run everywhere dashboard (assuming you have access to index=_internal
) and you will get an idea how to do it:
<form>
<label>Drop down pie</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>Please select:</label>
<search>
<query>index=_internal | stats count values(sourcetype) AS sourcetypes by sourcetype</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<choice value="*">all</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=$field1$ | stats count by date_minute</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</form>
Hope this helps ...
cheers, MuS
Hi ramabu,
take this run everywhere dashboard (assuming you have access to index=_internal
) and you will get an idea how to do it:
<form>
<label>Drop down pie</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>Please select:</label>
<search>
<query>index=_internal | stats count values(sourcetype) AS sourcetypes by sourcetype</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<choice value="*">all</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=$field1$ | stats count by date_minute</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</form>
Hope this helps ...
cheers, MuS
Oh, MuS! Thank you very much! that was quick and to the point!
For anyone who may be referencing this --
A.
I could not use the single-column result set I had [policyinfo | transaction ip | stats values(policy)] - had to rephrase it to something like the query in the example.
B.
I had to tweak the time constraints to get this to work in my case.
Nice you got this working now - feel free to accept the answer in this case, thanks 🙂