Dashboards & Visualizations

Can I dynamically add charts to a dashboard?

Ancillas
New Member

I have a search that I'm using to display timeseries data on the uptime of webservers. Unfortunately, squishing all of the hosts into a single chart makes it hard to see. I'd prefer to have a panel for each individual host, but I don't want to update the panel everytime I add or remove a host.

Here's what I'm using now.

source="status.log" | replace up with 1 in status | replace down with 0 in status | timechart span=1m first(status) by host

Is there a way to do something like

source="status.log" host="$host" | replace up with 1 in status | replace down with 0 in status | timechart span=1m first(status)

and then pass in an array of hosts to use in place of $host so that I got a chart for each host?

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

if the list of host is the result of a search, you can use a sub search

source="status.log" [search findmyhosts| dedup host | table host]
| replace up with 1 in status | replace down with 0 in status | timechart span=1m first(status) by host

or save the list of hosts in a lookup and call back the lookup in your subsearch.

Or if you want to do a form with the list of the host in a dropdown, read the dashboard editing options.
see http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...