Dashboards & Visualizations

Is there a way for a chart title to include data from a form field?

travis_bear
Explorer

For a chart in a view, is it possible to have the chart's title include data the user has entered into the search form field?

Here's my effort:

<form>
  <label>Resource Usage</label>
  <fieldset autoRun="true">
    <input type="text" token="host">
      <label>Host</label>
        <default>my_host</default>
        <prefix>orig_host="*</prefix>
        <suffix>*"</suffix>
    </input>
  </fieldset>    

  <row>
    <chart>
      <searchString>
         index=summary
         report=hw_use_by_jobs 
         $host$ |
         chart 
            p50(PercentProcessorTime_max) as "p50 CPU", 
            stdev(PercentProcessorTime_max) as "CPU stdev",
            count as DataPoints
            over ConcurrentTasks |
         eventstats sum(DataPoints) as Total_DataPoints  |
         eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
         fields "ConcurrentTasks" "Percent of Time"
      </searchString>
      <title>Concurrent Task Rates on $host$, last 30 days</title>
      <earliestTime>-30d</earliestTime>
      <latestTime>now</latestTime>
      <option name="drilldown">row</option>
      <option name="showPager">true</option>
      <option name="count">15</option>
      <option name="displayRowNumbers">false</option>
    </chart>
    ...

The chart's data renders as expected. Unfortunately, the chart's title does not include the user input. Instead, it is literally $host$. Is the search field information even available outside the scope of the <searchString> tag? If so, how is it accessed?

somesoni2
Revered Legend

This is certainely possible with Advanced xml (using sideview util).

0 Karma

sowings
Splunk Employee
Splunk Employee

Version? It should work as advertised in 6.0.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...