Customizing (Rather configuring) dashboard logic

[ronak]

Setup

An app that shows how certain function of business is doing during an event. I've Splunk 6.2 dashboard to show about 4~6 panels showing different metrics including what we call as time between states ...

These are calculated as time between different states of an order.

Need

Assume there are five states create, queue , submit, assign, confirm.

One client might require to combine create + queue as one state , while other may require create and queue to be different states of an order..

Meaning, client 1 may consider queue time as assign_timestamp - min(create_timestamp, queue_timestamp) ...client 2 might consider queue time as (quue_timestamp - create_timestamp)

Question

1. What is the best way to achieve such functionality such that I can configure these calculations as opposed to putting in queries or macros ...for example, can I create an external source of these states and calculations, and refer it in Splunk?

If so How ?

1. how to achieve the functionality such that when a third client comes with some different need, I can manipulate this external source with sequence of states and/or calculations

Thanks, ronak

[Runals]

I've monkeyed around with having a lookup that maps groups to specific alert to thresholds - something like

alert1,group1,5
alert1,group2,4
alert1,group3,10

What you are proposing potentially could be done in a lookup but my mind slides more toward a complex case statement like

...| eval queue_time = case(group=client1, assign_timestamp - min(create_timestamp, queue_timestamp), group=client2, quue_timestamp - create_timestamp, 1=1, "fix me") | ..

Of course that doesn't really fit what you are looking for; conditions not being in the query or a macro. Of course if you have it in a macro it makes it much easier to update and keep track of /shrug.