Dashboards & Visualizations

Force query result to display as chart

travis_bear
Explorer

I have the following query in Splunk 5:

index=summary
report=hw_use_by_jobs 
orig_host="my_host" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
   over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
fields "ConcurrentTasks" "Percent of Time"  "p50 CPU"

The output of this query is a table of numeric data, with a UI option I can click to display the results as a graphical chart. Is there any way I can specify in the query itself that I want the data to display initially as a chart instead of as a table?

My goal is to stick this chart into a view, so if there is a better approach to doing this in the query itself, I'm open to that as well.

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


View solution in original post

somesoni2
SplunkTrust
SplunkTrust

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


travis_bear
Explorer

Thank you that was helpful!

0 Karma

travis_bear
Explorer

@somesoni -- That's helpful. If you submit your comment as an answer, I will accept it. If you include a simple xml example, I will upvote it as well.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...