Dashboards & Visualizations

How to create charts for each host dynamically in a dashboard using simple xml?


Hello everyone.

I have a very simple search which I use to create a 100% Stack Bar showing the availability of a specific host:

host=myhostname index=availability sourcetype="avail" | stats avg(unavail) AS Unavailability, avg(avail) AS Availability by host

I know I could just replace the "myhostname" with "*" and create one graph with several host entries displaying their availability, but what I'd like to do is create one graph for each host on a Dashboard dynamically, that is, if a new server starts to send logs do splunk, this dashboard will automatically create a new graph containing it's availability.

And I need to do this using Simple XML (if possible), my access to our Splunk server is currently limited. So far, I found the "depends" property which I can use with the "chart" element, which means that this chart will only be displayed if the tokens in the "depends" property actually exists, but I could figure out a way to use it.

Any ideas?



Have you tried using multi-series mode? Just set multi-series mode to "yes" in your chart properties and Splunk will make a different chart for each of the field you are splitting by (host in your case). This won't give each chart its own panel, but it will give a chart for each host. Is that close enough?

0 Karma


Oops, doesn't quite work they way I thought. Disregard this answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...