Dashboards & Visualizations

Auto scale up/down of visualization panel in splunk dashboard

SureshkumarD
Explorer

Hi Team,

I extracted each webpage details which is dynamic based on the time range for one of our application. Is it possible to auto scale up/down the visualization panel (like single value) in the splunk dashboard based on the output of the splunk query? For example, if suppose dev team added/removed the webpage or functionality, the visualization panel should be created/deleted automatically. Thank you in advance.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Probably - the token you could try to use in the drilldown is $trellis.value$

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This question is too vague - yes, some auto-scaling can be done under certain circumstances, but whether is is possible for your usecase is yet to be determined. Perhaps you could share some sample events, the searches you are using and your current dashboard designs. Also, include what you have tried so far, and a mock up of what you would like it to look like (if possible).

0 Karma

SureshkumarD
Explorer

Hi,

  • Here is the query and the results. Visualization panels should get created/deleted automatically depends on the rows under the Page column.

 

index="*" appID="*" environment=* tags="*" stepName="*" status=FAILED

| rex field=stepName "^(?<Page>[^\:]+)"

| rex field=stepName "^\'(?<Page>[^\'\:]+)"

| rex field=stepName "\:(?P<action>.*)"

| eval Page=lower(Page)

| stats count(scenario) as "Number of Scenarios" by Page

| table Page, "Number of Scenarios"

SureshkumarD_0-1712074011376.png

 

  • I created the created single value visualization panel manually based on the rows, but if the rows are decreased dynamically, I could see N/A in most of the visualization panels. So, auto-scaling of visualization panel is needed in this scenario.

 

SureshkumarD_1-1712074011378.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would trellis layout work for you? Note that this is limited to 20 per page in Classic / SimpleXML dashboards, but Studio allows you to set the number per page.

0 Karma

SureshkumarD
Explorer

Hi,

Thank you for the prompt response. Trellis layout can be one of the options. However, for example, If I click on DB, then it should redirect to the separate visualization where we need to view the in-depth details only for DB and not for MEMBERDASHBOARD or TASKEDIT. Is it possible, please let me know. 

SureshkumarD_0-1712083779879.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably - the token you could try to use in the drilldown is $trellis.value$

SureshkumarD
Explorer

Hi @ITWhisperer ,

I tried the token, but it is not working as expected. Could you please assist on this?

 

SureshkumarD_0-1712580971981.png

Here is the redirection destination dashboard below.

SureshkumarD_1-1712581111460.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share the source of your dashboard in a code block so we can see what you have attempted.

0 Karma

SureshkumarD
Explorer

@ITWhisperer ,

Here is the Data source for the source dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"

 

Here is the Data source for the destination dashboard.

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="$scenariosTok$" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| rex field=stepName "\:(?P<action>.*)"
| search Page="$stepTok$"
| eval Page=upper(Page)
| stats list(action) as Actions by Page,scenario,error_log
| rename Page as "Page(Step)",scenario as Scenarios,error_log as "Exceptions"
| table Page(Step),Scenarios,Actions,Exceptions

 

Finally, Here are the data sources for the two drop downs added in the destination dashboard.

Scenarios dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| search Page="$stepTok$"
| stats count by scenario

 

Page dropdown

index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| search scenario="$scenariosTok$"
| stats count by Page

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share the source code of your dashboard

0 Karma

SureshkumarD
Explorer

Here is the source code for destination dashboard

{
"dataSources": {
"ds_PxUp5pVa": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"$scenariosTok$\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| rex field=stepName \"\\:(?P<action>.*)\"\r\n| search Page=\"$stepTok$\"\r\n| eval Page=upper(Page)\r\n| stats list(action) as Actions by Page,scenario,error_log\r\n| rename Page as \"Page(Step)\",scenario as Scenarios,error_log as \"Exceptions\"\r\n| table Page(Step),Scenarios,Actions,Exceptions",
"queryParameters": {}
},
"name": "APP-xxx_THAAProperxxx_regressionactions"
},
"ds_GTBvsceW": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search scenario=\"$scenariosTok$\" \r\n| stats count by Page"
},
"name": "steps"
},
"ds_0peRb3iY": {
"type": "ds.search",
"options": {
"query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search Page=\"$stepTok$\"\r\n| stats count by scenario",
"queryParameters": {}
},
"name": "Scenarios"
}
},
"visualizations": {
"viz_Qido8tOl": {
"type": "splunk.table",
"options": {
"count": 100,
"dataOverlayMode": "none",
"drilldown": "none",
"showInternalFields": false,
"backgroundColor": "#FAF9F6",
"tableFormat": {
"rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",
"headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",
"rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)",
"headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"
}
},
"dataSources": {
"primary": "ds_PxUp5pVa"
},
"title": "Regression Results with Actions & Error Details"
},
"viz_wtfZ8Urm": {
"type": "splunk.markdown",
"options": {
"markdown": "***xxx***",
"fontColor": "#FAF9F6",
"fontSize": "custom",
"customFontSize": 34,
"fontFamily": "Arial"
}
},
"viz_wkircOE3": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#FAF9F6",
"strokeColor": "#000000"
}
},
"viz_KR6lYV6G": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#FAF9F6"
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-7d@h,now"
},
"title": "Global Time Range"
},
"input_7pdCBCBD": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"defaultValue": "*",
"token": "scenariosTok"
},
"title": "Scenarios",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_0peRb3iY"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"scenario\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"scenario\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
},
"input_mv3itLP9": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"defaultValue": "*",
"token": "stepTok"
},
"title": "Page(Steps)",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_GTBvsceW"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"Page\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"Page\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
}
},
"layout": {
"type": "absolute",
"options": {
"width": 2000,
"height": 2500,
"display": "auto",
"backgroundColor": "#294e70"
},
"structure": [
{
"item": "viz_wkircOE3",
"type": "block",
"position": {
"x": 10,
"y": 50,
"w": 1980,
"h": 1810
}
},
{
"item": "viz_wtfZ8Urm",
"type": "block",
"position": {
"x": 10,
"y": 10,
"w": 1580,
"h": 50
}
},
{
"item": "viz_KR6lYV6G",
"type": "block",
"position": {
"x": 20,
"y": 60,
"w": 1950,
"h": 510
}
},
{
"item": "viz_Qido8tOl",
"type": "block",
"position": {
"x": 30,
"y": 70,
"w": 1930,
"h": 490
}
}
],
"globalInputs": [
"input_global_trp",
"input_7pdCBCBD",
"input_mv3itLP9"
]
},
"title": "xxx",
"description": "",
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
},
"refreshType": "delay",
"refresh": "5m"
}
}
}
}
}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This source does not seem to match the visualisation you have shown earlier. Are you using a trellis of singles or not?

0 Karma

SureshkumarD
Explorer

Hi @ITWhisperer ,

Source code has huge lines so I am unable to paste it or attach as a file. Kindly advise.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't have to be whole dashboard, but it should at least match the visualisation you shared earlier, or, if it doesn't then share the part that isn't working for you (so we can try and test it, or our solutions, for you).

0 Karma

SureshkumarD
Explorer

@ITWhisperer 

Here is the source code of trellis single value visualization

{
    "type""splunk.singlevalue",
    "options": {
        "numberPrecision"0,
        "sparklineDisplay""below",
        "trendDisplay""absolute",
        "unitPosition""after",
        "shouldUseThousandSeparators"true,
        "trellisMinColumnWidth"120,
        "trellisRowHeight"68,
        "majorValue""> sparklineValues | lastPoint()",
        "trendValue""> sparklineValues | delta(-2)",
        "sparklineValues""> primary | seriesByName('Number of Scenarios')",
        "trellisSplitBy""Page",
        "splitByLayout""trellis",
        "trellisPageCount"1000,
        "backgroundColor""#d41f1f",
        "majorColor""#FAF9F6",
        "trellisBackgroundColor""#FAF9F6"
    },
    "context": {
        "convertedColorRange": [
            {
                "from"100,
                "value""#dc4e41"
            },
            {
                "from"70,
                "to"100,
                "value""#f1813f"
            },
            {
                "from"30,
                "to"70,
                "value""#f8be34"
            },
            {
                "from"0,
                "to"30,
                "value""#0877a6"
            },
            {
                "to"0,
                "value""#53a051"
            }
        ]
    },
    "dataSources": {
        "primary""ds_P7P9WCoL_ds_TheWXmJx_ds_ionW1KZM"
    },
    "eventHandlers": [
        {
            "type""drilldown.linkToDashboard",
            "options": {
                "app""search",
                "dashboard""reliability_layer_3_insight_application_dashboard__thaa_proper",
                "newTab"true,
                "tokens": []
            }
        },
        {
            "type""drilldown.setToken",
            "options": {
                "tokens": [
                    {
                        "token""stepTok",
                        "key""trellis.value"
                    }
                ]
            }
        }
    ],
    "showProgressBar"false,
    "showLastUpdated"false,
    "hideWhenNoData"false
}
 
Here is the datasource used for the this visualization.
 
index="xxx" appID="APP-xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=PASSED
| rex field=stepName "^(?<Page>[^\:]+)"
| rex field=stepName "^\'(?<Page>[^\'\:]+)"
| eval Page=upper(Page)
| stats count(scenario) as "Number of Scenarios" by Page
| sort - "Number of Scenarios"
0 Karma

SureshkumarD
Explorer

Hi @ITWhisperer ,

Could you please provide an update on this request? Thank you,

0 Karma

SureshkumarD
Explorer

Can someone assist on this request please? Thank you.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...