Dashboards & Visualizations

Trellis Dashboard define rows?

ddecker03
Loves-to-Learn Everything

So I am working off a query based off the Splunk app for *nix.  It uses the interfaces.sh.  

 

query: index=os sourcetype=interfaces host=server Name=eth* | head 8 | eval status = if (RXbytes = "0", "UP", 'DOWN") | stats values(RXbytes) by Name

 

Basically I want to show the 8 interfaces, have the # of RX Bytes in each Single Value and color coded for UP/DOWN - which I set via the dashboard option 

0-1 - Red

1-500 - Yellow

500 - Max - Green

Also starting to wonder if I really need the eval statement in there?  I

I would like it to look like

ETH1   ETH 2  ETH 3  ETH 4  

ETH 5  ETH 6  ETH 7  ETH 8

vice

ETH1 ETH2 ETH 3 ETH 4 ETH 5 ETH 6

ETH 7 ETH 8

 

is that possible, sorry system is not connected so its kind of a pain to get screen shots.

 

Labels (3)
0 Karma

@ddecker03  refer to one of my older answers to set the width of Trellis panels dynamically based on number of results. https://community.splunk.com/t5/Dashboards-Visualizations/Trellis-to-align-automatically-to-the-pane...

However, since you want icon/value/color kind of visualization, you may try out Status Indicator Custom Visualization: https://splunkbase.splunk.com/app/3119/

Following is a run anywhere example with some Text Box based CSS configuration for you to test out whether you want single row or two rows of trellis (with 11% and 12% width respectively)

Screen Shot 2020-09-30 at 1.54.08 PM.png
Screen Shot 2020-09-30 at 1.53.54 PM.png

 Following is the required Simple XML run anywhere example:

<form>
  <label>Trellis Width</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="trellisWidth" searchWhenChanged="true">
      <label>Trellis Width %</label>
      <default>22</default>
    </input>
    <input type="text" token="trellisHeight" searchWhenChanged="true">
      <label>Trellis Height</label>
      <default>80px</default>
    </input>
    <input type="text" token="trellisFontSize" searchWhenChanged="true">
      <label>Trellis Font Size</label>
      <default>60px</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <style>
          #my_single_trellis div.viz-facet{
            $tokWidth$
            height: $trellisHeight$ !important;
          }
          div.splunk-status-indicator{
            font-size: $trellisFontSize$ !important;
          }
        </style>
      </html>
      <viz id="my_single_trellis" type="status_indicator_app.status_indicator">
        <search>
          <progress>
            <condition match="$job.resultCount$==8">
              <set token="tokWidth">width: $trellisWidth$% !important;</set>
            </condition>
            <condition>
              <set token="tokWidth">width: initial;</set>
            </condition>
          </progress>
          <query>index=_internal sourcetype=splunkd component IN ("*or", "*er")
| fields component date_second
| dedup component
| head 8
| rename date_second as RXbytes
| eval icon=if(RXbytes=0,"check-circle","times-circle")
| eval color=case(RXbytes&gt;=0 AND RXbytes&lt;1,"red",
                RXbytes&gt;=1 AND RXbytes&lt;500,"orange",
                RXbytes&gt;=500,"green")
| stats last(RXbytes) as RXbytes last(icon) as icon last(color) as color by component
| fields - "$trellisWidth$" "$trellisHeight$" "$trellisFontSize$"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="height">239</option>
        <option name="refresh.display">progressbar</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Richfez
SplunkTrust
SplunkTrust

I think the following search may do better?

index=os sourcetype=interfaces host=server Name=eth* 
| stats sum(RXbytes) AS rxbytes by Name

By doing the 'head 8' up front, you were just taking the first 8 rows.  But  do you know for sure what 8 rows it is?  Is 8 exactly and precisely correct always and is it always the first 8?  Just saying that feels a little suspicious, so I don't do that.

If you want to trim it back to 8,  that's of course perfectly fine, but I'd do it *after* the stats.  Then at least you'd know what order it's in (by name).

Or if you want to do it to the 8 most active ones, add

| sort - rxbytes
| head 8

to the end of the above.

ALSO I fixed something.  I'm not sure you wanted "values()" for the RXbytes.  I mean, maybe, but it again feels suspiciously accidental that your head 8 worked just right so that you had one and only one entry for each name, because if for some reason you had two, you'd have an multi-valued field there, like "18737, 7663" instead of the sum of the two.

So, maybe all this is not important, but I feel that even if it isn't right now, it will be some day when you try to extend this process to a server with only 4 NICs.  Or 12.

 

To you last question on reordering the columns/rows of a trellis. My understanding is nope, you get what you get.  Indeed, it also pages at a certain amount, and that amount of baby-trellis pictures that it makes you go to a second page for? Yeah, that's not even an evenly filled out row unless you accidentally made your browser the right size.  Nope, sometimes it's midway through a row that it just stops and tells you to click for the next page.  *sigh*  Wouldn't it be great to have an option like "columns=4 rows=2 overall=8" or some combination thereof?

In fact, that's such a good idea that I just wrote it up in Splunk Ideas. Go vote on it! https://ideas.splunk.com/ideas/EID-I-586

ddecker03
Loves-to-Learn Everything

Thanks Everyone, will have to try these solutions out.  

 

You are probably right Richfez, I just created a search that provided what I was looking for, have not validated that it will always provide the correct data :).  Its the initial stages.  

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...