Hi,
(I have attached the code I have used as a 'Run anywhere' example.)
WHAT I HAVE
I have a dashboard which initally displays a list of batch jobs,
When I click on any of the job names, I want 2 tables to be displayed below it,
Latest Job information, Job statistics
I have managed to make this work by using the logic,
<row>
<panel>
<html>
<a href="?showBatchJob1=true">
<h1>Batch Job 1</h1>
</a>
</html>
</panel>
</row>
<row depends="$showBatchJob1$">
<!---------------------------------------------------
Code to display the two tables
------------------------------------------------------>
</row>
WHAT I NEED:
The problem is, when each of the links are clicked, the entire page is reloaded and the data is taking a long time to load.
Is there a quicker way of doing this?
Thanks,
Deepak
FULL CODE:
<dashboard>
<label>Mockup</label>
<row>
<panel>
<html>
<a href="?showBatchJob1=true">
<h1>Batch Job 1</h1>
</a>
</html>
</panel>
</row>
<row depends="$showBatchJob1$">
<panel>
<title></title>
<table>
<title>Latest Job Information</title>
<search>
<query>index=*
| eval "Last Job ended" ="00:00:00"
| eval "Job Status"="NOT DEFINED"
| eval "Duration per Event" =0
| eval "No. of Events" =0
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events"
| transpose
| rename column as "Statistic"
| rename "row 1" as "Value"</query>
<earliest>rt-10s</earliest>
<latest>rtnow</latest>
</search>
</table>
</panel>
<panel>
<table>
<title>Job Statistics</title>
<search>
<query>index=*
| eval "Start Date"=strftime(now(),"%Y-%m-%d")
| eval "Start Time"=strftime(now(),"%T")
| eval "End Date"=strftime(now(),"%Y-%m-%d")
| eval "End Time"=strftime(now(),"%T")
| eval "Duration in minutes"=0
| eval Status="INCOMPLETE"
| eval "No. of Records"=0
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<html>
<a href="?showBatchJob2=true">
<h1>Batch Job 2</h1>
</a>
</html>
</panel>
</row>
<row depends="$showBatchJob2$">
<panel>
<title></title>
<table>
<title>Latest Job Information</title>
<search>
<query>index=main
| eval "Last Job ended" ="00:00:00"
| eval "Job Status"="NOT DEFINED"
| eval "Duration per Event" =0
| eval "No. of Events" =0
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events"
| transpose
| rename column as "Statistic"
| rename "row 1" as "Value"</query>
<earliest>rt-10s</earliest>
<latest>rtnow</latest>
</search>
</table>
</panel>
<panel>
<table>
<title>Job Statistics</title>
<search>
<query>index=*
| eval "Start Date"=strftime(now(),"%Y-%m-%d")
| eval "Start Time"=strftime(now(),"%T")
| eval "End Date"=strftime(now(),"%Y-%m-%d")
| eval "End Time"=strftime(now(),"%T")
| eval "Duration in minutes"=0
| eval Status="INCOMPLETE"
| eval "No. of Records"=0
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<html>
<a href="?showBatchJob3=true">
<h1>Batch Job 3</h1>
</a>
</html>
</panel>
</row>
<row depends="$showBatchJob3$">
<panel>
<title></title>
<table>
<title>Latest Job Information</title>
<search>
<query>index=main
| eval "Last Job ended" ="00:00:00"
| eval "Job Status"="NOT DEFINED"
| eval "Duration per Event" =0
| eval "No. of Events" =0
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events"
| transpose
| rename column as "Statistic"
| rename "row 1" as "Value"</query>
<earliest>rt-10s</earliest>
<latest>rtnow</latest>
</search>
</table>
</panel>
<panel>
<table>
<title>Job Statistics</title>
<search>
<query>index=*
| eval "Start Date"=strftime(now(),"%Y-%m-%d")
| eval "Start Time"=strftime(now(),"%T")
| eval "End Date"=strftime(now(),"%Y-%m-%d")
| eval "End Time"=strftime(now(),"%T")
| eval "Duration in minutes"=0
| eval Status="INCOMPLETE"
| eval "No. of Records"=0
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<html>
<a href="?showBatchJob4=true">
<h1>Batch Job 4</h1>
</a>
</html>
</panel>
</row>
<row depends="$showBatchJob4$">
<panel>
<title></title>
<table>
<title>Latest Job Information</title>
<search>
<query>index=main
| eval "Last Job ended" ="00:00:00"
| eval "Job Status"="NOT DEFINED"
| eval "Duration per Event" =0
| eval "No. of Events" =0
| stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events"
| transpose
| rename column as "Statistic"
| rename "row 1" as "Value"</query>
<earliest>rt-10s</earliest>
<latest>rtnow</latest>
</search>
</table>
</panel>
<panel>
<table>
<title>Job Statistics</title>
<search>
<query>index=*
| eval "Start Date"=strftime(now(),"%Y-%m-%d")
| eval "Start Time"=strftime(now(),"%T")
| eval "End Date"=strftime(now(),"%Y-%m-%d")
| eval "End Time"=strftime(now(),"%T")
| eval "Duration in minutes"=0
| eval Status="INCOMPLETE"
| eval "No. of Records"=0
| table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</dashboard>
@deepak02, You can use link input instead of html anchor tags if you just want to set or unset the token. Following is an example of Link Switcher that you can use.
<input type="link" token="selToken">
<label></label>
<choice value="linkBatchJob1">Show Batch Job 1</choice>
<choice value="linkBatchJob2">Show Batch Job 2</choice>
<choice value="linkBatchJob3">Show Batch Job 2</choice>
<change>
<condition value="linkBatchJob1">
<set token="showBatchJob1">true</set>
<unset token="showBatchJob2"></unset>
<unset token="showBatchJob3"></unset>
</condition>
<condition value="linkBatchJob2">
<unset token="showBatchJob1"></unset>
<set token="showBatchJob2">true</set>
<unset token="showBatchJob3"></unset>
</condition>
<condition value="linkBatchJob1">
<unset token="showBatchJob1"></unset>
<unset token="showBatchJob2"></unset>
<set token="showBatchJob3">true</set>
</condition>
<condition>
<unset token="showBatchJob1"></unset>
<unset token="showBatchJob2"></unset>
<unset token="showBatchJob3"></unset>
</condition>
</change>
</input>
As far as performance optimization is concerned, have you posted original queries or are these some random mock queries?
Since you have provided mock queries, refer to following documents if you want to figure out search query optimization on your own:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization
http://docs.splunk.com/Documentation/Splunk/latest/Search/Writebettersearches
https://docs.splunk.com/Documentation/Splunk/latest/Search/Realtimeperformanceandlimitations
If you want the community to help with specific query optimization, you will have to provide actual search query.
Thankyou! This is what I am looking for.
I am unable to accept as answer though.
Glad I was able to help... Let me convert it to answer.
@deepak02 Please accept if this has resolved your issue so that this question gets marked as answered.