Dashboards & Visualizations

How to create a dynamic dashboard?

Prado
Explorer

Hi All,

   I'm trying to make my dashboard dynamic.  for example, if the search query responds with 5 values, I want 5 row & panel to be created dynamically in the dashboard. Likewise will it be possible to make the panels to be getting created based on the query output? Please assist me on this ask and I can add more details if needed 

 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you are talking about XML dashboards, then yes, you can do pretty much anything with dynamic panels through using tokens and event handlers inside the dashboard.

You can read about tokens here

https://docs.splunk.com/Documentation/Splunk/9.0.3/Viz/tokens

and the event handler reference details are here

https://docs.splunk.com/Documentation/Splunk/9.0.3/Viz/EventHandlerReference

but as a basic example when you type something into the box in this dashboard it will run a search that generates a random number 1-5 and then open that number of panels.

See the <done> section for the event handler logic and the depends="$token$" for dynamic display

<form>
  <label>Dynamic panels</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="start" searchWhenChanged="true">
      <label>Type something and hit return to refresh</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>This generates a random number from 1-5 and opens that number of panels</title>
      <table>
        <search>
          <done>
            <eval token="panel_1">if($job.resultCount$ &gt;= 1, "1", null())</eval>
            <eval token="panel_2">if($job.resultCount$ &gt;= 2, "2", null())</eval>
            <eval token="panel_3">if($job.resultCount$ &gt;= 3, "3", null())</eval>
            <eval token="panel_4">if($job.resultCount$ &gt;= 4, "4", null())</eval>
            <eval token="panel_5">if($job.resultCount$ &gt;= 5, "5", null())</eval>
          </done>
          <query>| makeresults
| fields - _time
``` $start$ ```
| eval panels=mvrange(1, random() % 5 + 2, 1)
| mvexpand panels
| eval panels = "Panel ".panels." open"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$panel_1$">
      <table>
        <title>This is panel $panel_1$</title>
        <search>
          <query>
| makeresults
| eval Name="Panel $panel_1$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$panel_2$">
      <table>
        <title>This is panel $panel_2$</title>
        <search>
          <query>
| makeresults
| eval Name="Panel $panel_2$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$panel_3$">
      <table>
        <title>This is panel $panel_3$</title>
        <search>
          <query>
| makeresults
| eval Name="Panel $panel_3$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$panel_4$">
      <table>
        <title>This is panel $panel_4$</title>
        <search>
          <query>
| makeresults
| eval Name="Panel $panel_4$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$panel_5$">
      <table>
        <title>This is panel $panel_5$</title>
        <search>
          <query>
| makeresults
| eval Name="Panel $panel_5$"
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Prado
Explorer

Thanks a lot , bowesmana 🙂 I'll try this out and this is really helpful.. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is the closest you are likely to get for dynamic dashboards. It is not possible to introduce new structure (rows and panels) dynamically with tokens, however, you can (as @bowesmana has shown) affect which rows and panels are displayed. This is because the structure is built before the tokens are evaluated. Potentially, you might be able to introduce new structures with Javascript, but the data displayed in the content may have to be already available somewhere in the document (if you can track it down). Good luck with that! 😀

Prado
Explorer

Thanks you Sir 🙂  this sure is helpful

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...