For example, on a railroad schematic diagram, based on query data output? By “dynamically”, I’d like to show an icon (of alarm) at a position when there is a data value exceeding a threshold corresponding to the position on the schematic diagram. If the corresponding value is below the threshold, then, no icon should be shown. Essentially, I want to show an alarm at the that position of the diagram.
It would be similar to an example of the room occupancy with “Splunk Dashboards (beta)” (app/splunk-dashboard-app/example-hub-workplace-readiness-detail), except that I only want to show those with the occupancy higher than a threshold, not those rooms with occupancy less than the threshold.
For the static icon display, it is similar to Splunk’s visualization of “choropleth map”, but the coordinates have no geolocation bearing. Rather I just want to place icons of my choosing on arbitrary coordinates on the schematic diagram, based on the data value whether exceeding a threshold.
I have explored to use “Splunk Dashboards (beta)”, but it does not permit to dynamically display and hide such alarm.
I wonder what would be a possible approach?
Is there any example of “custom renderer” overlaying visualization of query data on top of a schematic diagram, with dynamic behavior of showing and hiding?
Some pointers and examples would be appreciated. Thanks in advance!
@bowesmana Thanks for the pointer! The "Service Flow" seems very close to what I need.
Next, could you give me a pointer of a tutorial how to set up an app with the customization like Service Flow?
I'm not aware of any tutorial, but you should be able to get an understanding of how that works by looking at the dashboard source.
If you add /editxml to the end of the dashboard URL, it will show you the dashboard source. From looking at it earlier, I gather it is running some hidden searches in the dashboard that set tokens for the results needed and then it is simply using those tokens in an HTML panel at fixed x/y positions so that they overlay on the base image.
I've understood the example of how to display an icon and how to make it disappear. Now I need to figure out how to implement the drill-down on the icon displayed.
Any suggestion would be appreciated.
The more I study it, the more I feel that this is a generic requirement of placing single value visualization on a schematic diagram against a feature value, at the position specific to the feature value. Therefore, I raised an "idea" here: https://ideas.splunk.com/ideas/EID-I-945
Please review, comment, and support, if you agree.
I've studied service_now.xml which is a possible example for my requirements of dynamically overlaying icons.
I understand that using CSS I control the location of the overlay over a background picture displayed by HTML.
Furthermore, what would be triggering event for my new function to be called to determine the visibility of my icon? It's not like a user event (mouse click on some UI object), but just data update.
Thanks for your help with some pointer!
I've able to locate the relevant file:
$SPLUNK/etc/apps/itsy_bitsy_appdefault/data/ui/views/service_flow.xml :: this is the definition of the dashboard.
and I'm isolating the row element in the xml that contains the html code to overlay the icons.