Passing Token values to Overlay field in the line chart

[sanjai]

Hi Splunkers,

I am working on creating a column line chart dashboard that shows database lattency . I'm encountering a issue where I'm trying to pass a token value to overlay options for line chart representation over a column chart. Here are things currently i have,

My Chart and My SPL query:

SPL:

index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=*
| eval ds_file_path=ds_path."\\".ds_file
| chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine
| appendcols
[search index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=*
| eval ds_file_path=ds_path."\\".ds_file
| stats max(block_count) as total_blocks by ds_file_path]

I need to assign the overlay field value(avg_processing_time_per_block )from the line in SPL:

| chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine

The reason I'm attempting to assign it as a token is that the avg_processing_time_per_block has dynamic values (sometimes it may be 10 or 12 machines data ).instead of rwmini and rwws01.

Column has total_blocks value  

Or is there any ways to achieve this requirement?

Your thoughts on these are highly appreciated. Thank you in advance.

Sanjai

[ITWhisperer]

You could have a separate (hidden) panel which generates the value of the token that you use to set the overlay fields for this  panel

[sanjai]

Hi @ITWhisperer 
Thanks for reply ,

I understand ,
But correct me if i'm wrong

1.If i have a seperate hidden panel that gives my token value (avg_processing_time_per_block )

2.Then how can i assign the token $avg_processing_time_per_block$ value to overlay Fields

like these?
<option name="charting.chart.overlayFields">$avg_processing_time_per_block$ </option>

or 
<option name="charting.chart.overlayFields">avg_processing_time_per_block </option>

if i gives these a token then line chart have a single line named avg_processing_time_per_block but the requirement is the avg_processing_time_per_block has dynamic value 

My need is to how to assign the avg_processing_time_per_block value as token in  charting.chart.overlayFields

thanks,

[ITWhisperer]

As you are probably aware, the list of overlay fields is a comma-separated list of field name, so that's what you need in your token. You could try something like this

| stats values(machine) as avg_processing_time_per_block
| eval avg_processing_time_per_block=mvjoin(avg_processing_time_per_block,",")

You would then set your token on the done block of the search, using this field from the (first) results row and use it in your display panel settings

<option name="charting.chart.overlayFields">$avg_processing_time_per_block$ </option>

[sanjai]

Thanks @ITWhisperer  , it worked