Dashboards & Visualizations

Dashbaord creation single panel for two different index with their respective sourectypes

Path Finder

How do I Create a single dashboard panel with two different index and their respective source types displaying count for same field with a drop down suggesting for index selection i.e if i select a particular index from the dropdown respective count for that field is displayed and so on.

0 Karma

Champion

Hi

Check this and modify it accordingly

<form>
  <label>filter</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selectedindex">
      <label>Index Name</label>
      <fieldForLabel>title</fieldForLabel>
      <fieldForValue>title</fieldForValue>
      <search>
        <query>| rest /services/data/indexes | dedup title | table title</query>
      </search>
      <change>
        <condition>
          <unset token="form.sourcetype"></unset>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="sourcetype">
      <label>Source Type</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index="$selectedindex$" |stats count by sourcetype</query>
      </search>
    </input>
  </fieldset>
  <row depends="$sourcetype$">
    <panel>
      <table>
        <search>
          <query>index="$selectedindex$" sourcetype="$sourcetype$" |stats count by source</query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

Path Finder

Sharing the demo query details :

index=blc_db sourcetype=prd_spark_agg_blc_nginx_access OR
index=internal_smapi_db sourcetype=prd_spark_agg_smapi_be_events_per_request
|stats count by src
| bucket _time span=1d

Please help me in modifying the query

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!