Hello,
I am new to splunk and dashboards.
First of all, I need something like this;
I have about 20-30 different domains and different data comes from each of them.
In my first main dashboard, we can think of a box (single value) for each domainName. I want to write the last incoming data just below it.
Then, as an example, when I click on this domainName data, I want the last 24 hours line chart of that domainName to come up.
I wrote spl as follows but I could not get it as a variable.
How can I do this?
<dashboard version="1.1" theme="light">
<label>EPS by Domain Dashboard</label>
<search id="base_search">
<query>index=* sourcetype=test metric=epsbyDomain
| stats latest(EPS) as EPS, latest(EPSLimit) as EPSLimit by domainName
| eval underLabel="EPS / Limit: ".EPSLimit</query>
<earliest>-7d</earliest>
<latest>now</latest>
</search>
<search id="selected_domain_search" depends="$selected_domain$">
<query>index=* sourcetype=test metric=epsbyDomain domainName="$selected_domain$"
| timechart span=5m avg(EPS) as EPS</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
<row>
<panel>
<single>
<search base="base_search">
<query>| table domainName, EPS, underLabel</query>
</search>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">small</option>
<option name="trellis.splitBy">domainName</option>
<option name="underLabel">$row.underLabel$</option>
<option name="useColors">1</option>
<option name="colorMode">block</option>
<option name="rangeColors">["0x53a051","0x006d9c","0xf8be34","0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="numberPrecision">0</option>
<option name="height">500</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="selected_domain">$row.domainName$</set>
<set token="show_chart">true</set>
</drilldown>
</single>
</panel>
</row>
<row depends="$show_chart$">
<panel>
<title>Last 24 hours - $selected_domain$</title>
<chart>
<search base="selected_domain_search"></search>
<option name="charting.chart">line</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY.text">EPS</option>
<option name="charting.legend.placement">bottom</option>
</chart>
</panel>
</row>
</dashboard>
I added the all coding.
Hi @Snorlax
Do you have the full XML for your dashboard? This might make it easier for someone to update it and send back as a working example?
Do you have an input (text or dropdown for example) in your dashboard called "selected_domain" ?
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will