Solved: Auto scale up/down of visualization panel in splun...

SureshkumarD · ‎04-01-2024

Hi Team,

I extracted each webpage details which is dynamic based on the time range for one of our application. Is it possible to auto scale up/down the visualization panel (like single value) in the splunk dashboard based on the output of the splunk query? For example, if suppose dev team added/removed the webpage or functionality, the visualization panel should be created/deleted automatically. Thank you in advance.

ITWhisperer · ‎04-02-2024

Probably - the token you could try to use in the drilldown is $trellis.value$

View solution in original post

ITWhisperer · ‎04-01-2024

This question is too vague - yes, some auto-scaling can be done under certain circumstances, but whether is is possible for your usecase is yet to be determined. Perhaps you could share some sample events, the searches you are using and your current dashboard designs. Also, include what you have tried so far, and a mock up of what you would like it to look like (if possible).

SureshkumarD · ‎04-02-2024

Hi,

Here is the query and the results. Visualization panels should get created/deleted automatically depends on the rows under the Page column.

index="*" appID="*" environment=* tags="*" stepName="*" status=FAILED

| rex field=stepName "^(?<Page>[^\:]+)"

| rex field=stepName "^\'(?<Page>[^\'\:]+)"

| rex field=stepName "\:(?P<action>.*)"

| eval Page=lower(Page)

| stats count(scenario) as "Number of Scenarios" by Page

| table Page, "Number of Scenarios"

I created the created single value visualization panel manually based on the rows, but if the rows are decreased dynamically, I could see N/A in most of the visualization panels. So, auto-scaling of visualization panel is needed in this scenario.

ITWhisperer · ‎04-02-2024

Would trellis layout work for you? Note that this is limited to 20 per page in Classic / SimpleXML dashboards, but Studio allows you to set the number per page.

SureshkumarD · ‎04-02-2024

Hi,

Thank you for the prompt response. Trellis layout can be one of the options. However, for example, If I click on DB, then it should redirect to the separate visualization where we need to view the in-depth details only for DB and not for MEMBERDASHBOARD or TASKEDIT. Is it possible, please let me know.

ITWhisperer · ‎04-02-2024

Probably - the token you could try to use in the drilldown is $trellis.value$

SureshkumarD · ‎04-08-2024

Hi @ITWhisperer ,

I tried the token, but it is not working as expected. Could you please assist on this?

Here is the redirection destination dashboard below.

ITWhisperer · ‎04-08-2024

Please share the source of your dashboard in a code block so we can see what you have attempted.

SureshkumarD · ‎04-08-2024

@ITWhisperer ,

Here is the Data source for the source dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"

Here is the Data source for the destination dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="$scenariosTok$" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| rex field=stepName "\:(?P<action>.*)"
| search Page="$stepTok$"
| eval Page=upper(Page)
| stats list(action) as Actions by Page,scenario,error_log
| rename Page as "Page(Step)",scenario as Scenarios,error_log as "Exceptions"
| table Page(Step),Scenarios,Actions,Exceptions

Finally, Here are the data sources for the two drop downs added in the destination dashboard.

Scenarios dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| search Page="$stepTok$"
| stats count by scenario

Page dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| search scenario="$scenariosTok$"
| stats count by Page

ITWhisperer · ‎04-08-2024

Please share the source code of your dashboard

SureshkumarD · ‎04-08-2024

Here is the source code for destination dashboard

{
"dataSources": {
"ds_PxUp5pVa": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"$scenariosTok$\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| rex field=stepName \"\\:(?P<action>.*)\"\r\n| search Page=\"$stepTok$\"\r\n| eval Page=upper(Page)\r\n| stats list(action) as Actions by Page,scenario,error_log\r\n| rename Page as \"Page(Step)\",scenario as Scenarios,error_log as \"Exceptions\"\r\n| table Page(Step),Scenarios,Actions,Exceptions",
"queryParameters": {}
},
"name": "APP-xxx_THAAProperxxx_regressionactions"
},
"ds_GTBvsceW": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search scenario=\"$scenariosTok$\" \r\n| stats count by Page"
},
"name": "steps"
},
"ds_0peRb3iY": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search Page=\"$stepTok$\"\r\n| stats count by scenario",
"queryParameters": {}
},
"name": "Scenarios"
}
},
"visualizations": {
"viz_Qido8tOl": {
"type": "splunk.table",
"options": {
"count": 100,
"dataOverlayMode": "none",
"drilldown": "none",
"showInternalFields": false,
"backgroundColor": "#FAF9F6",
"tableFormat": {
"rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",
"headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",
"rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)",
"headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"
}
},
"dataSources": {
"primary": "ds_PxUp5pVa"
},
"title": "Regression Results with Actions & Error Details"
},
"viz_wtfZ8Urm": {
"type": "splunk.markdown",
"options": {
"markdown": "***xxx***",
"fontColor": "#FAF9F6",
"fontSize": "custom",
"customFontSize": 34,
"fontFamily": "Arial"
}
},
"viz_wkircOE3": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#FAF9F6",
"strokeColor": "#000000"
}
},
"viz_KR6lYV6G": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#FAF9F6"
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-7d@h,now"
},
"title": "Global Time Range"
},
"input_7pdCBCBD": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"defaultValue": "*",
"token": "scenariosTok"
},
"title": "Scenarios",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_0peRb3iY"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"scenario\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"scenario\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
},
"input_mv3itLP9": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"defaultValue": "*",
"token": "stepTok"
},
"title": "Page(Steps)",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_GTBvsceW"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"Page\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"Page\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
}
},
"layout": {
"type": "absolute",
"options": {
"width": 2000,
"height": 2500,
"display": "auto",
"backgroundColor": "#294e70"
},
"structure": [
{
"item": "viz_wkircOE3",
"type": "block",
"position": {
"x": 10,
"y": 50,
"w": 1980,
"h": 1810
}
},
{
"item": "viz_wtfZ8Urm",
"type": "block",
"position": {
"x": 10,
"y": 10,
"w": 1580,
"h": 50
}
},
{
"item": "viz_KR6lYV6G",
"type": "block",
"position": {
"x": 20,
"y": 60,
"w": 1950,
"h": 510
}
},
{
"item": "viz_Qido8tOl",
"type": "block",
"position": {
"x": 30,
"y": 70,
"w": 1930,
"h": 490
}
}
],
"globalInputs": [
"input_global_trp",
"input_7pdCBCBD",
"input_mv3itLP9"
]
},
"title": "xxx",
"description": "",
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
},
"refreshType": "delay",
"refresh": "5m"
}
}
}
}
}

ITWhisperer · ‎04-08-2024

This source does not seem to match the visualisation you have shown earlier. Are you using a trellis of singles or not?

SureshkumarD · ‎04-09-2024

Hi @ITWhisperer ,

Source code has huge lines so I am unable to paste it or attach as a file. Kindly advise.

ITWhisperer · ‎04-09-2024

It doesn't have to be whole dashboard, but it should at least match the visualisation you shared earlier, or, if it doesn't then share the part that isn't working for you (so we can try and test it, or our solutions, for you).

SureshkumarD · ‎04-09-2024

@ITWhisperer

Here is the source code of trellis single value visualization

{

"type": "splunk.singlevalue",

"options": {

"numberPrecision": 0,

"sparklineDisplay": "below",

"trendDisplay": "absolute",

"unitPosition": "after",

"shouldUseThousandSeparators": true,

"trellisMinColumnWidth": 120,

"trellisRowHeight": 68,

"majorValue": "> sparklineValues | lastPoint()",

"trendValue": "> sparklineValues | delta(-2)",

"sparklineValues": "> primary | seriesByName('Number of Scenarios')",

"trellisSplitBy": "Page",

"splitByLayout": "trellis",

"trellisPageCount": 1000,

"backgroundColor": "#d41f1f",

"majorColor": "#FAF9F6",

"trellisBackgroundColor": "#FAF9F6"

},

"context": {

"convertedColorRange": [

{

"from": 100,

"value": "#dc4e41"

},

{

"from": 70,

"to": 100,

"value": "#f1813f"

},

{

"from": 30,

"to": 70,

"value": "#f8be34"

},

{

"from": 0,

"to": 30,

"value": "#0877a6"

},

{

"to": 0,

"value": "#53a051"

}

]

},

"dataSources": {

"primary": "ds_P7P9WCoL_ds_TheWXmJx_ds_ionW1KZM"

},

"eventHandlers": [

{

"type": "drilldown.linkToDashboard",

"options": {

"app": "search",

"dashboard": "reliability_layer_3_insight_application_dashboard__thaa_proper",

"newTab": true,

"tokens": []

}

},

{

"type": "drilldown.setToken",

"options": {

"tokens": [

{

"token": "stepTok",

"key": "trellis.value"

}

]

}

],

"showProgressBar": false,

"showLastUpdated": false,

"hideWhenNoData": false

}

Here is the datasource used for the this visualization.

index="xxx" appID="APP-xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=PASSED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"

SureshkumarD · ‎04-12-2024

Hi @ITWhisperer ,

Could you please provide an update on this request? Thank you,

SureshkumarD · ‎04-18-2024

Can someone assist on this request please? Thank you.

Auto scale up/down of visualization panel in splunk dashboard

Other

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

Preparing your Splunk Environment for OpenSSL3

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector