Dashboards & Visualizations

Show loadjob results as pie chart

Path Finder

HI

I use a dropdown in simple XML to select between different scheduled saved searches. As far as I know, in simple XML I can only use the tag "searchTeamplate" to work with variables.

so I use loadjob to get the results of my search within the searchTemplate tag:


| loadjob savedsearch="username:appname:mysearch-$timerange$"

Switching between different scheduled saved searches (using "timerange" as value) works fine like that. But the results all apear as table.

How can I produce other output than tables (i.e. pie charts) with loadjob results?

Kind regards
Mathias

Tags (2)
0 Karma

Path Finder

Try to give the answer myself.

I think the search was too complicated (including "append") and it was already computed with a stats command. I did a much simpler search using streamstats and now I can use whatever charts (i.e. pie) with loadjob.

.. mathu

0 Karma

Splunk Employee
Splunk Employee

With simple XML, the format of the output has to do with the type of XML element inside your <row> elements. You can use <table>, <chart>, <events>, etc. It's not affected by the type of search you're doing.

0 Karma

Path Finder

In this case it's not a problem of the XML element. If I use for example, I get no result in my View.

The problem is that "loadjob" only generates table output, even if I use in simple xml.

Maybe "loadjob" is not the correct way to search. But so far it't the only command I've found for my problem.

0 Karma