Dashboards & Visualizations

Is there a way for a chart title to include data from a form field?

travis_bear
Explorer

For a chart in a view, is it possible to have the chart's title include data the user has entered into the search form field?

Here's my effort:

<form>
  <label>Resource Usage</label>
  <fieldset autoRun="true">
    <input type="text" token="host">
      <label>Host</label>
        <default>my_host</default>
        <prefix>orig_host="*</prefix>
        <suffix>*"</suffix>
    </input>
  </fieldset>    

  <row>
    <chart>
      <searchString>
         index=summary
         report=hw_use_by_jobs 
         $host$ |
         chart 
            p50(PercentProcessorTime_max) as "p50 CPU", 
            stdev(PercentProcessorTime_max) as "CPU stdev",
            count as DataPoints
            over ConcurrentTasks |
         eventstats sum(DataPoints) as Total_DataPoints  |
         eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
         fields "ConcurrentTasks" "Percent of Time"
      </searchString>
      <title>Concurrent Task Rates on $host$, last 30 days</title>
      <earliestTime>-30d</earliestTime>
      <latestTime>now</latestTime>
      <option name="drilldown">row</option>
      <option name="showPager">true</option>
      <option name="count">15</option>
      <option name="displayRowNumbers">false</option>
    </chart>
    ...

The chart's data renders as expected. Unfortunately, the chart's title does not include the user input. Instead, it is literally $host$. Is the search field information even available outside the scope of the <searchString> tag? If so, how is it accessed?

somesoni2
Revered Legend

This is certainely possible with Advanced xml (using sideview util).

0 Karma

sowings
Splunk Employee
Splunk Employee

Version? It should work as advertised in 6.0.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...