Dashboards & Visualizations
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

Parallel Coordinates in a simple XML form

ivantn21
Explorer
‎10-16-2013 11:28 AM

I'm trying to add a drop down menu to the parallel coordinates visualization that is available on the Splunk 6 dashboard examples apps... But it seems to not work at all... any help?? here you have the view xml

<form script="autodiscover.js">
    <label>D3 Parallel Coordinates</label>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select a Sourcetype:</label>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<default>*</default>
<choice value="*">All</choice>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
<![CDATA[index=_internal | stats count by sourcetype]]>
</populatingSearch>
</input>
</fieldset>
    <row>
        <html>
            <h2>Metrics: Pipeline</h2>

            <div id="custom_search"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": "index=_internal $source$ component=Metrics group=pipeline | dedup 2 name,processor | table name processor cpu_seconds executes cummulative_hits",
                        "earliest_time": "-1h"
                    }'>
            </div>

            <div id="custom"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search",
                        "height": 400
                    }'>
            </div>

        </html>
    </row>
    <row>
        <html>
            <h2>Metrics: Queue</h2>

            <div id="custom_search2"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": "index=_internal $source$ component=Metrics group=queue | dedup name | table name max_size_kb current_size largest_size smallest_size",
                        "earliest_time": "-1h"
                    }'>
            </div>

            <div id="custom2"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search2",
                        "height": 300
                    }'>
            </div>

        </html>
    </row>
</form>
Tags (2)
Reply

nfilippi_splunk
Splunk Employee
Splunk Employee
‎10-17-2013 08:25 AM

Can you clarify what you mean by not work at all? Is this view within the simple_xml_examples app space, or do you have it in a separate app? If separate, do you have the referenced autodiscover.js in your appserver/static directory? Does it work if you remove the token reference within the search?

If it otherwise works when you remove the tokens in your search, then go ahead and try this xml to ensure that the search gets reloaded on token change.

<form script="autodiscover.js">
    <label>D3 Parallel Coordinates</label>
    <fieldset autoRun="true" submitButton="false">
        <input type="dropdown" token="source" searchWhenChanged="true">
            <label>Select a Sourcetype:</label>
            <prefix>sourcetype="</prefix>
            <suffix>"</suffix>
            <default>*</default>
            <choice value="*">All</choice>
            <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
                <![CDATA[index=_internal | stats count by sourcetype]]>
            </populatingSearch>
        </input>
        <input type="time" searchWhenChanged="true">
            <default>
                <earliestTime>-60m@m</earliestTime>
                <latestTime>now</latestTime>
            </default>
        </input>
    </fieldset>
    <row>
        <html>
            <h2>Metrics: Pipeline</h2>

            <div id="custom_search"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": { "type": "token_safe", "value": "index=_internal $$source$$ component=Metrics group=pipeline | dedup 2 name,processor | table name processor cpu_seconds executes cummulative_hits" },
                        "earliest_time": { "type": "token_safe", "value": "$$earliest$$" },
                        "latest_time": { "type": "token_safe", "value": "$$latest$$" }
                    }'>
            </div>

            <div id="custom"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search",
                        "height": 400
                    }'>
            </div>

        </html>
    </row>
    <row>
        <html>
            <h2>Metrics: Queue</h2>

            <div id="custom_search2"
                 class="splunk-manager"
                 data-require="splunkjs/mvc/searchmanager"
                 data-options='{
                        "search": { "type": "token_safe", "value": "index=_internal $$source$$ component=Metrics group=queue | dedup name | table name max_size_kb current_size largest_size smallest_size" },
                        "earliest_time": { "type": "token_safe", "value": "$$earliest$$" },
                        "latest_time": { "type": "token_safe", "value": "$$latest$$" }
                    }'>
            </div>

            <div id="custom2"
                 class="splunk-view"
                 data-require="app/simple_xml_examples/components/parallelcoords/parallelcoords"
                 data-options='{
                        "managerid": "custom_search2",
                        "height": 300
                    }'>
            </div>

        </html>
    </row>
</form>
Reply

sajbutler
Path Finder
‎09-17-2014 07:08 PM

Yep. I can confirm that the token_safe you specified in the XML makes it work. Thanks so much!

0 Karma
Reply

ivantn21
Explorer
‎10-17-2013 02:44 PM

Thanks... I'm using it in the same example app... this xml did work... Thanks

0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...