Dashboards & Visualizations

How to display the name of the FAILUR And SUCCESS Fields correctly through TREND

aditsss
Motivator

Hi Team,

I have one requirement.

I have one TREND Chart where I am showing FAILURE ,SUCCESS AND Total Counts in a trend.

The problem I am facing is I have one drop down "Build Result" which consists of 3 values

AllBuildResult

SUCCESS

FAILURE

the problem is when I am selecting " SUCCESS" from drop down the values are coming Right but its showing Total as label instead of SUCCESS. same is happening with FAILURE  as well.

Below is my code:

<row>
<panel>
<chart>
<title>Jenkins Builds Deployment Report</title>
<search>
<query>index="abc" sourcetype="xyz" $orgname$ $buildresult$ |
timechart span=1d count(BuildResult) by BuildResult useother=f limit=25|addtotals</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
<sampleRatio>1</sampleRatio>
</search-->
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.showMarkers">1</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineDashStyle">longDash</option>
<option name="height">400</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">OrgFolderName</option>
</chart>
</panel>
</row>

Can someone guide me on that.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK change to 

| search BuildResult="$buildresult$"

And you should be good to go

View solution in original post

aditsss
Motivator

I am not getting any result

 

<row>
<panel>
<chart>
<title>Jenkins Builds Deployment Report</title>
<search>
<query>index="abc" sourcetype="xyz" $orgname$ | bin _time span=1d
| stats count by _time BuildResult
| appendpipe [ stats sum(count) as count by _time | eval BuildResult="AllBuildResult" ]
| sort _time
| where BuildResult="*"
| xyseries _time BuildResult count</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
<sampleRatio>1</sampleRatio>
</search-->
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.showMarkers">1</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="height">400</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">OrgFolderName</option>
</chart>
</panel>
</row>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, you need to change where to search

0 Karma

aditsss
Motivator

@ITWhisperer 

 

After changing where to search I am to see the result .

Below is my code:

<row>
<panel>
<chart>
<title>Jenkins Builds Deployment Report</title>
<search>
<query>index="abc" sourcetype="xyz" $orgname$ | bin _time span=1d
| stats count by _time BuildResult
| appendpipe [ stats sum(count) as count by _time | eval BuildResult="AllBuildResult" ]
| sort _time
| search BuildResult="*"
| xyseries _time BuildResult count</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<latest>$field4.latest$</latest>
<sampleRatio>1</sampleRatio>
</search-->
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.showMarkers">1</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="height">400</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">OrgFolderName</option>
</chart>
</panel>
</row>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK change to 

| search BuildResult="$buildresult$"

And you should be good to go

aditsss
Motivator

@ITWhisperer 

 

You are best as always. Thank you so much for the solution.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...