Dashboards & Visualizations

Force query result to display as chart

travis_bear
Explorer

I have the following query in Splunk 5:

index=summary
report=hw_use_by_jobs 
orig_host="my_host" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
   over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
fields "ConcurrentTasks" "Percent of Time"  "p50 CPU"

The output of this query is a table of numeric data, with a UI option I can click to display the results as a graphical chart. Is there any way I can specify in the query itself that I want the data to display initially as a chart instead of as a table?

My goal is to stick this chart into a view, so if there is a better approach to doing this in the query itself, I'm open to that as well.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


View solution in original post

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


travis_bear
Explorer

Thank you that was helpful!

0 Karma

travis_bear
Explorer

@somesoni -- That's helpful. If you submit your comment as an answer, I will accept it. If you include a simple xml example, I will upvote it as well.

0 Karma

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table).

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...