Dashboards & Visualizations
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

Making dashboard efficient

deepak02
Path Finder
‎06-06-2017 01:45 PM

Hi,

(I have attached the code I have used as a 'Run anywhere' example.)

WHAT I HAVE
I have a dashboard which initally displays a list of batch jobs,

  • Batch Job 1
  • Batch Job 2
  • Batch Job 3
  • Batch Job 4

When I click on any of the job names, I want 2 tables to be displayed below it,

Latest Job information, Job statistics

I have managed to make this work by using the logic,

  <row>
    <panel>
      <html>
      <a href="?showBatchJob1=true">
          <h1>Batch Job 1</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob1$">
<!---------------------------------------------------
Code to display the two tables 
------------------------------------------------------>
</row>

WHAT I NEED:

The problem is, when each of the links are clicked, the entire page is reloaded and the data is taking a long time to load.
Is there a quicker way of doing this?

Thanks,
Deepak

FULL CODE:

<dashboard>
  <label>Mockup</label>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob1=true">
          <h1>Batch Job 1</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob1$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=* 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob2=true">
          <h1>Batch Job 2</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob2$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=main 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob3=true">
          <h1>Batch Job 3</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob3$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=main 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <a href="?showBatchJob4=true">
          <h1>Batch Job 4</h1>
        </a>
    </html>
    </panel>
  </row>
  <row depends="$showBatchJob4$">
    <panel>
      <title></title>
      <table>
        <title>Latest Job Information</title>
        <search>
          <query>index=main 
| eval "Last Job ended" ="00:00:00" 
| eval "Job Status"="NOT DEFINED" 
| eval "Duration per Event" =0 
| eval "No. of Events" =0 
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" 
| transpose 
| rename column as "Statistic" 
| rename "row 1" as "Value"</query>
          <earliest>rt-10s</earliest>
          <latest>rtnow</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>Job Statistics</title>
        <search>
          <query>index=* 
| eval "Start Date"=strftime(now(),"%Y-%m-%d") 
| eval "Start Time"=strftime(now(),"%T") 
| eval "End Date"=strftime(now(),"%Y-%m-%d") 
| eval "End Time"=strftime(now(),"%T") 
| eval "Duration in minutes"=0 
| eval Status="INCOMPLETE" 
| eval "No. of Records"=0 
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
Tags (2)
0 Karma
Reply

niketn
Legend
‎06-07-2017 01:56 AM

@deepak02, You can use link input instead of html anchor tags if you just want to set or unset the token. Following is an example of Link Switcher that you can use.

<input type="link" token="selToken">
  <label></label>
  <choice value="linkBatchJob1">Show Batch Job 1</choice>
  <choice value="linkBatchJob2">Show Batch Job 2</choice>
  <choice value="linkBatchJob3">Show Batch Job 2</choice>
  <change>
    <condition value="linkBatchJob1">
      <set token="showBatchJob1">true</set>
      <unset token="showBatchJob2"></unset>
      <unset token="showBatchJob3"></unset>
    </condition>
    <condition value="linkBatchJob2">
      <unset token="showBatchJob1"></unset>
      <set token="showBatchJob2">true</set>
      <unset token="showBatchJob3"></unset>
    </condition>
    <condition value="linkBatchJob1">
      <unset token="showBatchJob1"></unset>
      <unset token="showBatchJob2"></unset>
      <set token="showBatchJob3">true</set>
    </condition>
    <condition>
      <unset token="showBatchJob1"></unset>
      <unset token="showBatchJob2"></unset>
      <unset token="showBatchJob3"></unset>
    </condition>
  </change>
</input>

As far as performance optimization is concerned, have you posted original queries or are these some random mock queries?

Since you have provided mock queries, refer to following documents if you want to figure out search query optimization on your own:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization
http://docs.splunk.com/Documentation/Splunk/latest/Search/Writebettersearches
https://docs.splunk.com/Documentation/Splunk/latest/Search/Realtimeperformanceandlimitations

If you want the community to help with specific query optimization, you will have to provide actual search query.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply

deepak02
Path Finder
‎06-07-2017 07:17 AM

Thankyou! This is what I am looking for.

I am unable to accept as answer though.

0 Karma
Reply

niketn
Legend
‎06-07-2017 07:27 AM

Glad I was able to help... Let me convert it to answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply

niketn
Legend
‎06-09-2017 12:51 PM

@deepak02 Please accept if this has resolved your issue so that this question gets marked as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...