I have the following query in Splunk 5:
index=summary
report=hw_use_by_jobs
orig_host="my_host" |
chart
p50(PercentProcessorTime_max) as "p50 CPU",
stdev(PercentProcessorTime_max) as "CPU stdev",
count as DataPoints
over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints |
eval "Percent of Time"=100*DataPoints/Total_DataPoints |
fields "ConcurrentTasks" "Percent of Time" "p50 CPU"
The output of this query is a table of numeric data, with a UI option I can click to display the results as a graphical chart. Is there any way I can specify in the query itself that I want the data to display initially as a chart instead of as a table?
My goal is to stick this chart into a view, so if there is a better approach to doing this in the query itself, I'm open to that as well.
When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>IndexStats</label>
<!-- Place panels within rows -->
<row>
<table>
<title>Top Sourcetypes (Last 24 hours)</title>
<!-- A search powers the panel -->
<searchString>
****You search query****
</searchString>
<!-- Specify a time range for the search -->
<earliestTime>-24h@h</earliestTime>
<latestTime>now</latestTime>
<!-- Use options to further define how to display result data -->
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
</table>
</row>
<row>
<chart>
<title>PerIndexThruputChart</title>
<searchString>
****You search query****
</searchString>
<!-- Specify a time range for the search -->
<earliestTime>-24h@h</earliestTime>
<latestTime>now</latestTime>
<!-- Use options to further define how to display result data -->
<option name="charting.chart">bar</option>
</chart>
When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>IndexStats</label>
<!-- Place panels within rows -->
<row>
<table>
<title>Top Sourcetypes (Last 24 hours)</title>
<!-- A search powers the panel -->
<searchString>
****You search query****
</searchString>
<!-- Specify a time range for the search -->
<earliestTime>-24h@h</earliestTime>
<latestTime>now</latestTime>
<!-- Use options to further define how to display result data -->
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
</table>
</row>
<row>
<chart>
<title>PerIndexThruputChart</title>
<searchString>
****You search query****
</searchString>
<!-- Specify a time range for the search -->
<earliestTime>-24h@h</earliestTime>
<latestTime>now</latestTime>
<!-- Use options to further define how to display result data -->
<option name="charting.chart">bar</option>
</chart>
Thank you that was helpful!
@somesoni -- That's helpful. If you submit your comment as an answer, I will accept it. If you include a simple xml example, I will upvote it as well.
When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table).