Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Reusable Panel

philipp
Explorer
‎07-16-2020 03:17 AM

Dear community,

is it possible with plain Dashboard-XML (no JavaScript) to create a reusable component (panels).

In my example I have a huge dashboard with many rows, panels and charts.

I want the possibility to display and hide everything and parts of it. This is done by tokens and they XML-Keyword depends. So this works just fine. I can display and hide panels / rows via multiple filters.

But I in general I only have like 2 different kind of charts with defined Options containing something like coloring, size and so on. My actual approach is to copy and paste the same charts and paste in another search (everything else keeps the same).

Therefore my current dashboard contains 1801 lines of "code", in this case XML-Tags.

To display it via code I want something like this:

<!-- definition -->
<my-custom-panel>
  <title>$title$</title>
  <chart>
    <search>
      <query>$search-query$</query>
      <earliest>$date_range.earliest$</earliest>
      <latest>$date_range.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="refresh.display">progressbar</option>
  </chart>
</my-custom-panel>


<!-- usage -->
<my-custom-panel title="chart1" search-query="index ..."/>
<my-custom-panel title="chart2" search-query="index ..."/>

 

This would reduce my code to something like 500 lines of code and it would be much more easy to handle.

HINT: I have seen the feature about Prebuild Panels  but that does not solve my  problem here.

Thank you so much 😊

Kind regards,

Philipp

Labels (4)
Labels
Tags (2)
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

niketn
Legend
‎07-20-2020 05:47 AM

@philipp  the reason why I had asked those question was to gauge how you can create re-usable sections in your dashboard.

1) Using tokens for SPLs inside same panel will help you a bit with the dropdown options running same search/panel but with different SPL with token. (All will still need to show all panels).

2. On similar lines as above, even Prebuilt Panel in your case will take the panels out of the current Simple XML and place them as separate code. It will only help you reduce actual lines of Simple XML code for various Dropdown options like Component and Environment as they can be passed to Prebuilt panels as tokens.

3. If you had slight design change to show same type of visualization like all Columns charts together and all Line charts together, you could have taken advantage of Trellis layout to split by Component and Environment. Then you will actually have only two panels searches one for Column Chart and another for Line chart and based on the dropdown value the Chart Splits will happen dynamically (including All condition).

4. Best fit seems to be Simple XML JS extension with Splunk JS stack to build viz based on options selected. Simple XML will only pass the Search to be executed and possibly chart type/config. While this would be helpful to reduce code if you have several searches and each search splitting out in several charts, you are right that code reduction will result in complexity introduced by the JS layer.

You have to pick and choose how much Simple XML code you want to reduce vs option you can adopt. Also is the code reduction for reducing the disk usage by Simple XML dashboard or for better readability by developers (for the later Simple XML source code editor does provide the option to expand/collapse specific Simple XML element.)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Reply
Solved! Jump to solution

niketn
Legend
‎07-17-2020 02:04 PM

If you want to reduce the content of Simple XML and re-use same panel code over different dashboards, prebuilt panel is the way. However, if it is just readability, the source code editor allows you to expand collapse specific sections of code manually when you are editing.

If your intent is to just change the tokens for various panels, why not create single panel with all the elements that change as tokens?

Ideally if your use case is more complicated, you should resort to JS. Specific reason for avoiding JS?

For the two sample panels in your question do you have the actual code which you have right now and what is expected to be changed.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Reply
Solved! Jump to solution

philipp
Explorer
‎07-19-2020 10:53 PM

Minimal working example (part 1):

 

 

<form>
  <label>minimalWorkingExample</label>
  <description>for splunk question</description>
  <fieldset submitButton="false">
    <input type="time" token="date_range" searchWhenChanged="true">
      <label>Date Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="env" searchWhenChanged="true">
      <label>Stage</label>
      <choice value="prd">Production</choice>
      <choice value="tst">Test</choice>
      <default>prd</default>
      <initialValue>prd</initialValue>
    </input>
    <input type="dropdown" token="project" searchWhenChanged="true">
      <label>Project</label>
      <choice value="all">All</choice>
      <choice value="project-one">ONE</choice>
      <choice value="project-two">TWO</choice>
      <change>
        <condition value="all">
          <set token="project-one">true</set>
          <set token="project-two">true</set>
          <unset token="project-not-all"></unset>
        </condition>
        <condition value="project-one">
          <set token="project-one">true</set>
          <set token="project-not-all">true</set>
          <unset token="project-two"></unset>
        </condition>
        <condition value="project-two">
          <set token="project-two">true</set>
          <set token="project-not-all">true</set>
          <unset token="project-one"></unset>
        </condition>
      </change>
      <initialValue>all</initialValue>
      <default>all</default>
    </input>
    <html>
      <style>
        /* Colors:
            https://material.io/design/color/#tools-for-picking-colors
        */
        div.html{
          padding:0px !important;
        }
        h1, h2, h3{
          margin:0px !important;
          padding:20px !important;
        }
        h1.one{
          background-color:#039BE5 !important; /* blue 600 */
        }
        h2.one{
          background-color:#29B6F6 !important; /* blue 400 */
        }
        h3.one{
          background-color:#81D4FA !important; /* blue 200 */
        }
        h1.two{
          background-color:#9E9E9E !important; /* grey 500 */
        }
        h2.two{
          background-color:#BDBDBD !important; /* grey 400 */
        }
        h3.two{
          background-color:#E0E0E0 !important; /* grey 300 */
        }

        h3.help {
          padding-bottom:0px !important;
        }
        p.help {
          padding: 0px 20px 0px 20px !important;
        }
      </style>
    </html>
  </fieldset>

  <![CDATA[
    # ========================================================
    # ONE
    # ========================================================
    # -->
  ]]>
  <row depends="$project-one$">
    <panel>
      <html>
        <h2 class="one">
          Project One
        </h2>
      </html>
    </panel>
  </row>
  <row depends="$project-one$">
    <panel>
      <title>Component XXX - stage: $env$</title>
      <chart>
        <search>
          <query>| makeresults | eval _time=1595203200, RUNNING=1, ERROR=0, MISSING_LOGS=0
            | append [ makeresults | eval _time=1595206800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595210400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595214000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595217600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595221200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595224800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595228400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595232000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595235600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595239200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595242800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | fields _time, RUNNING, MISSING_LOGS, ERROR
          </query>
          <earliest>$date_range.earliest$</earliest>
          <latest>$date_range.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"ERROR":0xdc4e41, "RUNNING":0x53a051, "MISSING_LOG":0xFFFF00}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">107</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Component YYY - stage: $env$</title>
      <chart>
        <search>
          <query>| makeresults | eval _time=1595203200, RUNNING=1, ERROR=0, MISSING_LOGS=0
            | append [ makeresults | eval _time=1595206800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595210400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595214000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595217600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595221200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595224800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595228400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595232000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595235600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595239200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595242800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | fields _time, RUNNING, MISSING_LOGS, ERROR
          </query>
          <earliest>$date_range.earliest$</earliest>
          <latest>$date_range.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"ERROR":0xdc4e41, "RUNNING":0x53a051, "MISSING_LOG":0xFFFF00}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">107</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>


  <row depends="$project-one$">
    <panel>
      <title>Component ZZZ - stage: $env$</title>
      <chart>
        <search>
          <query>| makeresults | eval _time=1595203200, "0"=10, "1"=5, "2"=3
            | append [ makeresults | eval _time=1595206800, "0"=20, "1"=23, "2"=7 ]
            | append [ makeresults | eval _time=1595210400, "0"=30, "1"=35, "2"=10 ]
            | append [ makeresults | eval _time=1595214000, "0"=0, "1"=40, "2"=15 ]
            | append [ makeresults | eval _time=1595217600, "0"=5, "1"=0, "2"=26 ]
            | append [ makeresults | eval _time=1595221200, "0"=7, "1"=15, "2"=28 ]
            | append [ makeresults | eval _time=1595224800, "0"=9, "1"=23, "2"=0 ]
            | append [ makeresults | eval _time=1595228400, "0"=12, "1"=27, "2"=3 ]
            | append [ makeresults | eval _time=1595232000, "0"=0, "1"=0, "2"=7 ]
            | append [ makeresults | eval _time=1595235600, "0"=6, "1"=6, "2"=17 ]
            | append [ makeresults | eval _time=1595239200, "0"=10, "1"=15, "2"=39 ]
            | append [ makeresults | eval _time=1595242800, "0"=50, "1"=35, "2"=60 ]
            | fields _time, "0", "1", "2"
          </query>
          <earliest>$date_range.earliest$</earliest>
          <latest>$date_range.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

 

0 Karma
Reply
Solved! Jump to solution

philipp
Explorer
‎07-19-2020 10:54 PM

Minimal working example (part 2):

(sorry hat to split the dashboard caused my the splunk-community-rules (message too long))

  <![CDATA[
    # ========================================================
    # TWO
    # ========================================================
    # -->
  ]]>
  <row depends="$project-two$">
    <panel>
      <html>
        <h2 class="two">
          Project Two
        </h2>
      </html>
    </panel>
  </row>
  <row depends="$project-two$">
    <panel>
      <title>Component XXX - stage: $env$</title>
      <chart>
        <search>
          <query>| makeresults | eval _time=1595203200, RUNNING=1, ERROR=0, MISSING_LOGS=0
            | append [ makeresults | eval _time=1595206800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595210400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595214000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595217600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595221200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595224800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595228400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595232000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595235600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595239200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595242800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | fields _time, RUNNING, MISSING_LOGS, ERROR
          </query>
          <earliest>$date_range.earliest$</earliest>
          <latest>$date_range.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"ERROR":0xdc4e41, "RUNNING":0x53a051, "MISSING_LOG":0xFFFF00}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">107</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Component YYY - stage: $env$</title>
      <chart>
        <search>
          <query>| makeresults | eval _time=1595203200, RUNNING=1, ERROR=0, MISSING_LOGS=0
            | append [ makeresults | eval _time=1595206800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595210400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595214000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595217600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595221200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595224800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595228400, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595232000, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595235600, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595239200, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | append [ makeresults | eval _time=1595242800, RUNNING=1, ERROR=0, MISSING_LOGS=0 ]
            | fields _time, RUNNING, MISSING_LOGS, ERROR
          </query>
          <earliest>$date_range.earliest$</earliest>
          <latest>$date_range.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"ERROR":0xdc4e41, "RUNNING":0x53a051, "MISSING_LOG":0xFFFF00}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">107</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>


  <row depends="$project-two$">
    <panel>
      <title>Component ZZZ - stage: $env$</title>
      <chart>
        <search>
          <query>| makeresults | eval _time=1595203200, "0"=10, "1"=5, "2"=3
            | append [ makeresults | eval _time=1595206800, "0"=20, "1"=23, "2"=7 ]
            | append [ makeresults | eval _time=1595210400, "0"=30, "1"=35, "2"=10 ]
            | append [ makeresults | eval _time=1595214000, "0"=0, "1"=40, "2"=15 ]
            | append [ makeresults | eval _time=1595217600, "0"=5, "1"=0, "2"=26 ]
            | append [ makeresults | eval _time=1595221200, "0"=7, "1"=15, "2"=28 ]
            | append [ makeresults | eval _time=1595224800, "0"=9, "1"=23, "2"=0 ]
            | append [ makeresults | eval _time=1595228400, "0"=12, "1"=27, "2"=3 ]
            | append [ makeresults | eval _time=1595232000, "0"=0, "1"=0, "2"=7 ]
            | append [ makeresults | eval _time=1595235600, "0"=6, "1"=6, "2"=17 ]
            | append [ makeresults | eval _time=1595239200, "0"=10, "1"=15, "2"=39 ]
            | append [ makeresults | eval _time=1595242800, "0"=50, "1"=35, "2"=60 ]
            | fields _time, "0", "1", "2"
          </query>
          <earliest>$date_range.earliest$</earliest>
          <latest>$date_range.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

</form>

 

0 Karma
Reply
Solved! Jump to solution
Solution

niketn
Legend
‎07-20-2020 05:47 AM

@philipp  the reason why I had asked those question was to gauge how you can create re-usable sections in your dashboard.

1) Using tokens for SPLs inside same panel will help you a bit with the dropdown options running same search/panel but with different SPL with token. (All will still need to show all panels).

2. On similar lines as above, even Prebuilt Panel in your case will take the panels out of the current Simple XML and place them as separate code. It will only help you reduce actual lines of Simple XML code for various Dropdown options like Component and Environment as they can be passed to Prebuilt panels as tokens.

3. If you had slight design change to show same type of visualization like all Columns charts together and all Line charts together, you could have taken advantage of Trellis layout to split by Component and Environment. Then you will actually have only two panels searches one for Column Chart and another for Line chart and based on the dropdown value the Chart Splits will happen dynamically (including All condition).

4. Best fit seems to be Simple XML JS extension with Splunk JS stack to build viz based on options selected. Simple XML will only pass the Search to be executed and possibly chart type/config. While this would be helpful to reduce code if you have several searches and each search splitting out in several charts, you are right that code reduction will result in complexity introduced by the JS layer.

You have to pick and choose how much Simple XML code you want to reduce vs option you can adopt. Also is the code reduction for reducing the disk usage by Simple XML dashboard or for better readability by developers (for the later Simple XML source code editor does provide the option to expand/collapse specific Simple XML element.)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Reply
Solved! Jump to solution

philipp
Explorer
‎07-19-2020 10:47 PM

Hy niketnilay,

thank you for your response and help for my problem.

Probably I explained it in the wrong way.

To answer all your questions:

  • "reduce the content of Simple XML and re-use same panel code over different dashboards"
    -> I want to re-use the same panel code within the same dashboard over and over again
  • "why not create single panel with all the elements that change as tokens"
    -> Because I want the possibility to display (make visible) all panels OR some chosen / selected panels (via Dropdowns)
  • "specific reason for avoiding JS"
    -> It is mainly to reduce the complexity. While I started to work with splunk I tested the usage of JS and it was way more complicated and therefore it is way more difficult to maintain and to understand for my colleagues.


For better explanation, here is a minimal working example of my dashboard
(see next post, had to split caused by too long message according SplunkCommunity-rules):

  • I made some example queries with makeresults
  • I put the stage inside the html (name) panel, in my real search this selects in my real world the stage (prod / test)
  • as you can see I had to copy the first few panels (from project one) without changing the chart and its options (in real world I would change the query here

Thank you so much

0 Karma
Reply
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...