How can I dynamically overlay graphic objects (icons) on top of a schematic diagram?

[yshen]

For example, on a railroad schematic diagram, based on query data output? By “dynamically”, I’d like to show an icon (of alarm) at a position when there is a data value exceeding a threshold corresponding to the position on the schematic diagram. If the corresponding value is below the threshold, then, no icon should be shown. Essentially, I want to show an alarm at the that position of the diagram.

It would be similar to an example of the room occupancy with “Splunk Dashboards (beta)” (app/splunk-dashboard-app/example-hub-workplace-readiness-detail), except that I only want to show those with the occupancy higher than a threshold, not those rooms with occupancy less than the threshold.

For the static icon display, it is similar to Splunk’s visualization of “choropleth map”, but the coordinates have no geolocation bearing. Rather I just want to place icons of my choosing on arbitrary coordinates on the schematic diagram, based on the data value whether exceeding a threshold.

I have explored to use “Splunk Dashboards (beta)”, but it does not permit to dynamically display and hide such alarm.

I wonder what would be a possible approach?

1. I heard that Splunk’s custom renderer might be able
2. Or, I should just export the data from Splunk to do the special visualization external to Splunk?

Is there any example of “custom renderer” overlaying visualization of query data on top of a schematic diagram, with dynamic behavior of showing and hiding?

Some pointers and examples would be appreciated. Thanks in advance!

[bowesmana · Accepted solution]

Take a look at this app on Splunkbase, it has some examples to 

https://splunkbase.splunk.com/app/5256/

Look at the Service Flow example

[yshen]

@bowesmana Thanks for the pointer! The "Service Flow" seems very close to what I need.

Next, could you give me a pointer of a tutorial how to set up an app with the customization like Service Flow?

Thanks again!

[bowesmana]

I'm not aware of any tutorial, but you should be able to get an understanding of how that works by looking at the dashboard source.

If you add /editxml to the end of the dashboard URL, it will show you the dashboard source. From looking at it earlier, I gather it is running some hidden searches in the dashboard that set tokens for the results needed and then it is simply using those tokens in an HTML panel at fixed x/y positions so that they overlay on the base image.

[yshen]

I've understood the example of how to display an icon and how to make it disappear. Now I need to figure out how to implement the drill-down on the icon displayed. 

Any suggestion would be appreciated. 

The more I study it, the more I feel that this is a generic requirement of placing single value visualization on a schematic diagram against a feature value, at the position specific to the feature value. Therefore, I raised an "idea" here: https://ideas.splunk.com/ideas/EID-I-945

Please review, comment, and support, if you agree.

Thanks!

[yshen]

I've studied service_now.xml which is a possible example for my requirements of dynamically overlaying icons. 

I understand that using CSS I control the location of the overlay over a background picture displayed by HTML. 

Next, I guess that I need to use JavaScript to update the related CSS style for the overlay to make it visible or not depending on the value of query output.

I guess that I might be able to assign the query output to a token, and JavaScript code might be able to access the assigned value in a token. I should be able to use jQuery to retrieve the CSS style and update it. 

Now, the last question, how does my JavaScript code integrated with my dashboard definition in service_now.xml? I'm studying the example of appserver/static/scripts/advanced_model.js 

it seems that it's not mentioned in any of the dashboard definition. Is it by convention that any JavaScript code in the appserver/static/scripts/ would automatically integrate with app?

Furthermore, what would be triggering event for my new function to be called to determine the visibility of my icon? It's not like a user event (mouse click on some UI object), but just data update. 

Thanks for your help with some pointer!

[yshen]

Thanks!

I've able to locate the relevant file:

$SPLUNK/etc/apps/itsy_bitsy_appdefault/data/ui/views/service_flow.xml :: this is the definition of the dashboard.

and I'm isolating the row element in the xml that contains the html code to overlay the icons.