Dashboards & Visualizations

Trellis view - toggle between timechart view of 3 nodes(in one chart) into trellis view of 3 nodes (but 1 chart per node)

HattrickNZ
Motivator

hi there

I have a time chart panel that has 3 nodes in the chart/legend.
I want to be add a tick box or equivalent that allows the user to switch between
1/ the timechart view of the 3 nodes in one chart
to
2/ the trellis view which shows 3 seperate time charts(that is, one time chart per node)

what is the code to do this using simple XML?

pic show the time chart, on top, and the trellis view on the bottom.
I want a tick box to be able to switch between the 2, so they appear only in the one panel.
alt text

code below of the above 2 panes in the pic.

  <row>
    <panel>
      <title>test trelis view</title>
      <chart>
        <search>
          <query>index=core host="snzclakl598" elementType=MSCServer measObjLdn=* measInfoId=83888089  duration=PT900S |  timechart span=15m avg(c84163062) as "Outgoing Calls-Seizure Traffic" by userLabel</query>
          <earliest>@w0</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>test trelis view - want a tick box that jsut allows this to be turned into a trellis view</title>
      <chart>
        <search>
          <query>index=core host="snzclakl598" elementType=MSCServer measObjLdn=* measInfoId=83888089  duration=PT900S |  timechart span=15m avg(c84163062) as "Outgoing Calls-Seizure Traffic" by userLabel</query>
          <earliest>@w0</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
      </chart>
    </panel>
  </row>
Tags (3)
0 Karma

to4kawa
Ultra Champion

Sample(use index=_internal😞

<form>
  <label>trellis option test</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="toggle" searchWhenChanged="true">
      <label>Trellis toggle</label>
      <choice value="1">toggle</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal
| eval source=mvindex(split(source,"/"),-1)
| timechart useother=f count by source where sum in top3</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">$toggle$</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...