Dashboards & Visualizations

how to priorities the reports in a dashboard

matansocher
Contributor

Hi

I have a dashboard with 8-10 reports, and we have in our organization a limit of 5 searches per user. I want to see few reports before the others. Is it possible to priorities the reports and start searching one report before the other?

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

For whatever panels you want to run first, you can defined tokens from those search results on <done> event. See this http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Define_search_tokens
Set the token to something which will not affect the search such as 1=1.

Other lower priority panels should include those tokens in their search so that if they are not set (means higher priority searches are not done yet), those searches will not run.

View solution in original post

sonalsingh5255
Loves-to-Learn

please could you help me to know how you resolve it , i too want to do same

0 Karma

somesoni2
SplunkTrust
SplunkTrust

For whatever panels you want to run first, you can defined tokens from those search results on <done> event. See this http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Define_search_tokens
Set the token to something which will not affect the search such as 1=1.

Other lower priority panels should include those tokens in their search so that if they are not set (means higher priority searches are not done yet), those searches will not run.

matansocher
Contributor

Do you know that solution? because it gives me an error on that line:
noop
it says: Unexpected close tag

0 Karma

rjthibod
Champion

Please post the XML you are using. The issue could be a number of things depending on how you implemented it.

0 Karma

matansocher
Contributor

It is too big to post here but I will cut the most relevant parts.
after the input (that are serches by thier own) I have 4 reports like this one and they are the most important:

    <panel>
      <title>Open Tickets - All Priorities</title>
      <chart>
        <title>Service Now - Open Tickets</title>
        <search>
          <query>index=snow 
assignment_group_name=*israel* 
number!="Task*"
 dv_state="Open*" priority=* $assignee$
| dedup number 
| stats count(number) as number
| table number icon</query>
          <earliest>1483257600</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.rangeValues">[0,4000,6000,8000]</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.gaugeColors">["0x84E900","0xFFE800","0xBF3030"]</option>
        <option name="height">250</option>
      </chart>
    </panel>

and after I have 6 more reports that are "less important"
example for 1 of them:

 <panel>
      <title>Service Now - Time Invested on Tickets Per Queue In Hours</title>
      <chart>
        <search>
          <query>index=snow assignment_group_name=*israel* dv_state="Clos*" number!="Task*" $assignee$
| dedup number 
| eval year = substr(substr(closed_at,3,4),1,2) 
| eval _time = strptime(closed_at,"%Y-%m-%d %H:%M:%S")
| rex field=dv_u_total_time_spent "(?&lt;DAYS&gt;\d+)\s*Day" 
| rex field=dv_u_total_time_spent "(?&lt;HOURS&gt;\d+)\s*Hour" 
| rex field=dv_u_total_time_spent "(?&lt;MINS&gt;\d+)\s*Minute" 
| eval DAYS = if((isnull(DAYS)), 0, tonumber(DAYS)) 
| eval HOURS = if((isnull(HOURS)), 0, tonumber(HOURS)) 
| eval MINS = if((isnull(MINS)), 0, tonumber(MINS)) 
| eval FINAL_TIME=round(8*DAYS + HOURS + round(MINS/60,2))
| where year &gt; 16
| replace "*dfs*" with "DFS" "*win*" with "Windows" "*new_emp*" with "Others" "*user_exit*" with "Others" israel_accessory with "HW" israel_caesarea with "Others" israel_cars with "Others" israel_ci with "Unix &amp; Eng Comp" israel_eng_compute with "Unix &amp; Eng Comp" israel_free_sw_approval with "Others" israel_gen with "Others" israel_hw_issue with "HW" israel_it with "Others" israel_linux_install with "Others" israel_mis with "Others" israel_network with "Net/Telephony" israel_office_relo with "Others" israel_storage with "Others" israel_tel with "Net/Telephony" israel_unix with "Unix &amp; Eng Comp" israel_unix_eng_tools with "Unix &amp; Eng Comp" oit_hwamstock_kiosk_israel_a with "Kiosk" oit_israel_accessory with "HW" oit_israel_eng_compute with "Unix &amp; Eng Comp" oit_israel_gen with "Others" oit_israel_hw_issue with "HW" oit_israel_it with "Others" oit_israel_network with "Net/Telephony" oit_israel_tel with "Net/Telephony" oit_israel_unix with "Unix &amp; Eng Comp" oit_mcs_kiosk_israel_a with "Kiosk" qct_israel with "Others" qct_israel_mis with "Others" qct_israel_pri with "Others" qct_israel_unix with "Unix &amp; Eng Comp" mcs_kiosk_israel_a with "Kiosk" hwamstock_kiosk_israel_a with "Kiosk" israel_sparequeue3 with "CSR" OTHER with "Others" in assignment_group_name
| timechart span=1mon sum(FINAL_TIME) as "Number Of Hours" by assignment_group_name</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Number Of Hours</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="height">489</option>
      </chart>
    </panel>
0 Karma

rjthibod
Champion

OK, what exactly is causing / reporting an error? You did not include anything about the noop tokens in what you posted, so I don't know what is or isn't working.

0 Karma

matansocher
Contributor

oh sorry. I did forget to mention the line of the error.
when I try to add that code that has the tag progress and finalized, the error line is:

< unset token = "NOOP_1">noop

the error is: Unexpected close tag

0 Karma

rjthibod
Champion

That's because there is a small error in the closing tag. You should use this pattern instead.

       <progress>
          <unset token="NOOP_1"/>
       </progress>
       <done>
          <set token="NOOP_1">noop</set>
       </done>

rjthibod
Champion

Here is another question that did exactly what @somesoni2 suggested.

https://answers.splunk.com/answers/513660/how-to-set-loading-order-for-panels.html

As the comments in the accepted answer say, you will need to change finalized to done.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...