Dashboards & Visualizations

How to create a dashboard with dynamic StatisticTables for each month having data for specified date range (fromdate to todate)?

abhishekroy168
Path Finder

Hi,
I want to display the statistic table for each month dynamically. Within selected time range i have to filter the data according to monthwise.
so, please provide the SPL query to solve this problem using Simple XML.
Is it possible by simple Xml? If No, then how to do this in HTML with solution?
For Example: I want to display the data for the specified time as below: (fromdate=01/01/2018 and todate=31/03/2018)

Jan 2018

category no of incidents total operation time
Hardware 2 20
Software 4 60
Network 3 35

Feb 2018

category no of incidents total operation time
Hardware 1 20
Software 4 60
Network 2 10

same for daywise and weekwise according to the token selection.

Tags (1)
0 Karma

damiensurat
Contributor

This should help

Your search | bucket _time span=1month | stats sum(field1) as totalField1, sum(field2) as totalField2 by _time

Or

Your search | Timechart sum(field1) as TotalField1, sum(field2) as totalField2 span=1month.

0 Karma

tiagofbmm
Influencer

You just need to use the Time Picker and connect it to the statistics table.

Copy this simple XML and tell me if you are clarified

 <form>
      <label>Time</label>
      <fieldset submitButton="false">
        <input type="time" token="timepicker">
          <label></label>
          <default>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
          </default>
        </input>
        <input type="dropdown" token="src">
          <label>Sources</label>
          <fieldForLabel>source</fieldForLabel>
          <fieldForValue>source</fieldForValue>
          <search>
            <query>| tstats count where index=_internal by source</query>
            <earliest>$timepicker.earliest$</earliest>
            <latest>$timepicker.latest$</latest>
          </search>
        </input>
      </fieldset>
      <row>
        <panel>
          <table>
            <search>
              <query>| tstats count where index=_internal by source</query>
              <earliest>$timepicker.earliest$</earliest>
              <latest>$timepicker.latest$</latest>
            </search>
            <option name="drilldown">none</option>
            <option name="refresh.display">progressbar</option>
          </table>
        </panel>
      </row>
    </form>
0 Karma

damiensurat
Contributor

Can you provide the Search you are using? Are you using the timechart command in your search?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...