Dashboards & Visualizations

Draw chart dynamically based on search results

dyuen
Engager

Hi,

I am trying to gather a list of names and count each Name's success or fail, so I have a query like the following:

.... | stats count by Name, isSuccess

but I only want to the top 5 Names, in terms of count(i.e. regardless of isSuccess) and then graph each Name on a separate panel(e.g. a pie chart to see their ratio of isSuccess). Is this possible?

Tags (1)
0 Karma

niketn
Legend

@dyuen, Following is a run anywhere dashboard based on Splunk's _internal index which gets top 5 components in first panel (using Tag Cloud visualization). In the second panel it displays the Pie chart of Successful Count over Total using Trellis.

alt text

Following is the Simple XML code.

<form>
  <label>Top 5 Names and their success</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
        </default>
      </input>
      <viz type="simple_xml_examples.tagcloud">
        <title>Top Components</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="*"
| top 5 component</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="height">80</option>
        <option name="simple_xml_examples.tagcloud.labelField">component</option>
        <option name="simple_xml_examples.tagcloud.maxFontSize">20</option>
        <option name="simple_xml_examples.tagcloud.minFontSize">10</option>
        <option name="simple_xml_examples.tagcloud.valueField">count</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
      </viz>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Top Component Success Ratio Pie Chart</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="*" 
    [ search index=_internal sourcetype=splunkd log_level="*" earliest="$tokTime.earliest$" latest="$tokTime.latest$" 
    | top 5 component 
    | table component ] 
| eval isSuccess=if(log_level="INFO","Success","Fail") 
| stats count by component isSuccess</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">component</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@dyuen, if this answer has helped, please accept the answer to mark this question as answered. 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dyuen
Engager

Thanks @niketnilay,
The trellis layout you shown in the example is exactly what I needed!
The documentation is in https://docs.splunk.com/Documentation/Splunk/6.6.6/Viz/VisualizationTrellis

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...