Dashboards & Visualizations

Chart Data Preview

Ant1D
Motivator

Hi,

I was just asked if there was an option to disable the results preview for a chart for which I replied "Yes, there is". We just want to see the final chart with the full results instead of watching the chart build the results in stages as it loads.

So...using Simple XML I added the charting.data.preview property to the end of the attributes that sit within chart tags but it did not disable the results preview:

   <option name="charting.chart">column</option>
  <option name="charting.axisTitleX.text">Time</option>
  <option name="charting.axisTitleX.visibility">visible</option>
  <option name="charting.axisTitleY.text">Count</option>
  <option name="charting.axisTitleY.visibility">visible</option>
  <option name="charting.chart.nullValueMode">gaps</option>
  <option name="charting.chart.stackMode">stacked</option>
  <option name="charting.chart.style">shiny</option>
  <option name="charting.drilldown">all</option>
  <option name="charting.layout.splitSeries">0</option>
  <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  <option name="charting.legend.placement">right</option>
  <option name="charting.axisX.scale">linear</option>
  <option name="charting.axisY.scale">linear</option>
  <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  <option name="charting.data.preview">false</option> 

Note: Some of the options were added to the XML by default when making chart changes using the Splunk UI. I am using Splunk v6.0.1.
My understanding according to the Chart Config Reference is that chart data preview is set to false by default so it should not be necessary for me to set the above option for it to work.
Any ideas why my chart continues to preview results? Could one of the other chart properties be the cause? Thanks in advance for your help.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This may not be achievable though SimpleXML configuration alone, or at least I don't know of a way.

However, you can disable the preview in regular searching (Statistics Tab -> No Preview) and save that search as a Report - the "No Preview" setting will persist. Similarly, using that Report on a Dashboard will honor that setting and not display a preview.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can always move to SplunkJS / the Web Framework where searches run by a SearchManager do have such a flag:

preview: Indicates if preview is enabled for this search job. By default, preview is enabled for realtime searches and for searches where status_buckets > 0. Set to false to disable preview.

http://docs.splunk.com/Documentation/WebFramework

That's used by SimpleXML underneath so it's all there, it just might not be passed down (yet?).

0 Karma

Ant1D
Motivator

Thanks Martin. I will give this a try and update this thread once I have. While it is not ideal, it is a workaround of sorts which is better than nothing 🙂 Not convinced I will be able to use this in a form with token inputs.

In Advanced XML it's easy to do via the EnablePreview module.

It would be interesting to know if anyone has had some trouble with this and what they did to fix that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...