Auto scale up/down of visualization panel in splunk dashboard

[SureshkumarD]

Hi Team,

I extracted each webpage details which is dynamic based on the time range for one of our application. Is it possible to auto scale up/down the visualization panel (like single value) in the splunk dashboard based on the output of the splunk query? For example, if suppose dev team added/removed the webpage or functionality, the visualization panel should be created/deleted automatically. Thank you in advance.

[ITWhisperer]

This question is too vague - yes, some auto-scaling can be done under certain circumstances, but whether is is possible for your usecase is yet to be determined. Perhaps you could share some sample events, the searches you are using and your current dashboard designs. Also, include what you have tried so far, and a mock up of what you would like it to look like (if possible).

[SureshkumarD]

Hi,

• Here is the query and the results. Visualization panels should get created/deleted automatically depends on the rows under the Page column.

index="*" appID="*" environment=* tags="*" stepName="*" status=FAILED

| rex field=stepName "^(?<Page>[^\:]+)"

| rex field=stepName "^\'(?<Page>[^\'\:]+)"

| rex field=stepName "\:(?P<action>.*)"

| eval Page=lower(Page)

| stats count(scenario) as "Number of Scenarios" by Page

| table Page, "Number of Scenarios"

• I created the created single value visualization panel manually based on the rows, but if the rows are decreased dynamically, I could see N/A in most of the visualization panels. So, auto-scaling of visualization panel is needed in this scenario.

[ITWhisperer]

Would trellis layout work for you? Note that this is limited to 20 per page in Classic / SimpleXML dashboards, but Studio allows you to set the number per page.

[SureshkumarD]

Hi,

Thank you for the prompt response. Trellis layout can be one of the options. However, for example, If I click on DB, then it should redirect to the separate visualization where we need to view the in-depth details only for DB and not for MEMBERDASHBOARD or TASKEDIT. Is it possible, please let me know. 

[ITWhisperer]

Probably - the token you could try to use in the drilldown is $trellis.value$

[SureshkumarD]

Hi @ITWhisperer ,

I tried the token, but it is not working as expected. Could you please assist on this?

Here is the redirection destination dashboard below.

[ITWhisperer]

Please share the source of your dashboard in a code block so we can see what you have attempted.

[SureshkumarD]

@ITWhisperer ,

Here is the Data source for the source dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"

Here is the Data source for the destination dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="$scenariosTok$" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| rex field=stepName "\:(?P<action>.*)"
| search Page="$stepTok$"
| eval Page=upper(Page)
| stats list(action) as Actions by Page,scenario,error_log
| rename Page as "Page(Step)",scenario as Scenarios,error_log as "Exceptions"
| table Page(Step),Scenarios,Actions,Exceptions

Finally, Here are the data sources for the two drop downs added in the destination dashboard.

Scenarios dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| search Page="$stepTok$"
| stats count by scenario

Page dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| search scenario="$scenariosTok$"
| stats count by Page

[ITWhisperer]

Please share the source code of your dashboard

[SureshkumarD]

Here is the source code for destination dashboard

{
"dataSources": {
"ds_PxUp5pVa": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"$scenariosTok$\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| rex field=stepName \"\\:(?P<action>.*)\"\r\n| search Page=\"$stepTok$\"\r\n| eval Page=upper(Page)\r\n| stats list(action) as Actions by Page,scenario,error_log\r\n| rename Page as \"Page(Step)\",scenario as Scenarios,error_log as \"Exceptions\"\r\n| table Page(Step),Scenarios,Actions,Exceptions",
"queryParameters": {}
},
"name": "APP-xxx_THAAProperxxx_regressionactions"
},
"ds_GTBvsceW": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search scenario=\"$scenariosTok$\" \r\n| stats count by Page"
},
"name": "steps"
},
"ds_0peRb3iY": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search Page=\"$stepTok$\"\r\n| stats count by scenario",
"queryParameters": {}
},
"name": "Scenarios"
}
},
"visualizations": {
"viz_Qido8tOl": {
"type": "splunk.table",
"options": {
"count": 100,
"dataOverlayMode": "none",
"drilldown": "none",
"showInternalFields": false,
"backgroundColor": "#FAF9F6",
"tableFormat": {
"rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",
"headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",
"rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)",
"headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"
}
},
"dataSources": {
"primary": "ds_PxUp5pVa"
},
"title": "Regression Results with Actions & Error Details"
},
"viz_wtfZ8Urm": {
"type": "splunk.markdown",
"options": {
"markdown": "***xxx***",
"fontColor": "#FAF9F6",
"fontSize": "custom",
"customFontSize": 34,
"fontFamily": "Arial"
}
},
"viz_wkircOE3": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#FAF9F6",
"strokeColor": "#000000"
}
},
"viz_KR6lYV6G": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#FAF9F6"
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-7d@h,now"
},
"title": "Global Time Range"
},
"input_7pdCBCBD": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"defaultValue": "*",
"token": "scenariosTok"
},
"title": "Scenarios",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_0peRb3iY"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"scenario\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"scenario\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
},
"input_mv3itLP9": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"defaultValue": "*",
"token": "stepTok"
},
"title": "Page(Steps)",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_GTBvsceW"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"Page\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"Page\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
}
},
"layout": {
"type": "absolute",
"options": {
"width": 2000,
"height": 2500,
"display": "auto",
"backgroundColor": "#294e70"
},
"structure": [
{
"item": "viz_wkircOE3",
"type": "block",
"position": {
"x": 10,
"y": 50,
"w": 1980,
"h": 1810
}
},
{
"item": "viz_wtfZ8Urm",
"type": "block",
"position": {
"x": 10,
"y": 10,
"w": 1580,
"h": 50
}
},
{
"item": "viz_KR6lYV6G",
"type": "block",
"position": {
"x": 20,
"y": 60,
"w": 1950,
"h": 510
}
},
{
"item": "viz_Qido8tOl",
"type": "block",
"position": {
"x": 30,
"y": 70,
"w": 1930,
"h": 490
}
}
],
"globalInputs": [
"input_global_trp",
"input_7pdCBCBD",
"input_mv3itLP9"
]
},
"title": "xxx",
"description": "",
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
},
"refreshType": "delay",
"refresh": "5m"
}
}
}
}
}

[ITWhisperer]

This source does not seem to match the visualisation you have shown earlier. Are you using a trellis of singles or not?

[SureshkumarD]

Hi @ITWhisperer ,

Source code has huge lines so I am unable to paste it or attach as a file. Kindly advise.

[ITWhisperer]

It doesn't have to be whole dashboard, but it should at least match the visualisation you shared earlier, or, if it doesn't then share the part that isn't working for you (so we can try and test it, or our solutions, for you).

[SureshkumarD]

@ITWhisperer 

Here is the source code of trellis single value visualization

{

    "type": "splunk.singlevalue",

    "options": {

        "numberPrecision": 0,

        "sparklineDisplay": "below",

        "trendDisplay": "absolute",

        "unitPosition": "after",

        "shouldUseThousandSeparators": true,

        "trellisMinColumnWidth": 120,

        "trellisRowHeight": 68,

        "majorValue": "> sparklineValues | lastPoint()",

        "trendValue": "> sparklineValues | delta(-2)",

        "sparklineValues": "> primary | seriesByName('Number of Scenarios')",

        "trellisSplitBy": "Page",

        "splitByLayout": "trellis",

        "trellisPageCount": 1000,

        "backgroundColor": "#d41f1f",

        "majorColor": "#FAF9F6",

        "trellisBackgroundColor": "#FAF9F6"

    },

    "context": {

        "convertedColorRange": [

            {

                "from": 100,

                "value": "#dc4e41"

            },

            {

                "from": 70,

                "to": 100,

                "value": "#f1813f"

            },

            {

                "from": 30,

                "to": 70,

                "value": "#f8be34"

            },

            {

                "from": 0,

                "to": 30,

                "value": "#0877a6"

            },

            {

                "to": 0,

                "value": "#53a051"

            }

        ]

    },

    "dataSources": {

        "primary": "ds_P7P9WCoL_ds_TheWXmJx_ds_ionW1KZM"

    },

    "eventHandlers": [

        {

            "type": "drilldown.linkToDashboard",

            "options": {

                "app": "search",

                "dashboard": "reliability_layer_3_insight_application_dashboard__thaa_proper",

                "newTab": true,

                "tokens": []

            }

        },

        {

            "type": "drilldown.setToken",

            "options": {

                "tokens": [

                    {

                        "token": "stepTok",

                        "key": "trellis.value"

                    }

                ]

            }

        }

    ],

    "showProgressBar": false,

    "showLastUpdated": false,

    "hideWhenNoData": false

}

Here is the datasource used for the this visualization.

index="xxx" appID="APP-xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=PASSED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"

[SureshkumarD]

Hi @ITWhisperer ,

Could you please provide an update on this request? Thank you,

[SureshkumarD]

Can someone assist on this request please? Thank you.