Populate Dashboard/View with Panels/Graphs based on Search (Dynamic Dashboard)

[jeffa]

Is it possible to dynamically populate a dashboard/view with panels/charts based on search results? For example, I track disk utilization across my systems w/ Splunk, and I'd like to be able to create a dashboard of disk utilization graphs only for disks whose utilization has changed by a specified amount. In other words, of our 100+ disks, only 10 or so will have changed utilization over the last week, but the set of changed disks will not be the same from day to day.

So, I want one panel/chart per disk (with a few items for that disk charted). The number of disks, as well as which disks should be charted would be dynamic. So, if I have 5 servers w/ C: drives, and only servers 1 and 4 have significant change in the last week, I want the view/dashboard to display two graphs/panels, one for the disk on server 1, and one for the disk on server 4. If the next week, servers 3-5 have disks w/ significant change, I want the view/dashboard to display three graphs/panels, one for server3, one for server4, one for server5

[acdevlin]

Absolutely! Check out the following app for some examples and ideas: http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

The source code for all examples can be found in the Manager. You should be able to do what you want using simplified xml; I'd strongly recommend looking at the "Form Search Intro" section, since I believe it is most relevant to what you're looking for.

You could also check out the documentation about putting a chart in a dashboard: http://docs.splunk.com/Documentation/Splunk/latest/Developer/AddAChart

[jeffa]

Multiple panels are a key requirement. Ultimately I want to email this dashboard as a PDF, so no user interaction will be possible for that.

[acdevlin]

I can think of one potential alternative, though. What if you set up a dashboard to:

1) Search for the disks which changed in the last week

2) Dynamically populate a dropdown menu based on the disks returned from step 1

3) Use the disk selected from the dropdown to populate a single panel containing the data you want to see.

Would this work for your current project, or are multiple panels a key requirement?

[acdevlin]

Ah, I did misunderstand you a bit earlier...my mistake!

This old answer seems to have something relevant, though I have not tried this myself: http://splunk-base.splunk.com/answers/11813/how-to-dynamically-generate-a-dashboard-in-which-the-of-...

It, unfortunately, seems rather complicated...

[jeffa]

Thanks for the suggestion on the ui examples app. I may be missing something, but I don't see what I'm looking for in those examples. I may need to be wording this better, but what I want to do is populate a dashboard with a dynamically generated set of panels. The number of panels (changed disks) and set of changed disks will be different from day to day.