Help with Dashboard panel features?

[Ash1]

I have a dashboard where I want to get the following features:

1. Drill down option i mentioned to "Link to search" but when i am clicking on the graph it is the search page is opening in same tab, but i want to open that in another tab.
2. I have another panel where the bar graph is showing by hosts, so i want to show up different colors for each host, how can i do this.

3. i want to display the values on the graph, it is displaying but it is overlapping, how can make them display clearly.

[SanjayReddy]

Hi

please find following repponses
1. Drill down option i mentioned to "Link to search" but when i am clicking on the graph it is the search page is opening in same tab, but i want to open that in another tab.

in dashboard panel seetins you can check option open in tab , then your drilldown open in new tab

2. I have another panel where the bar graph is showing by hosts, so i want to show up different colors for each host, how can i do this.

you can use follwing option to give cutsom colors

<option name="charting.fieldColors">{"count": #66FF00}</option>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference?_ga=2.144048631....

[Ash1]

Hi @SanjayReddy , thank you for replying .

1. now its working as expected-Drill down option in new tab.

2. I have another panel where the bar graph is showing by hosts, so i want to show up different colors for each host, how can i do this

For this my query is: index=asdf sourcetype=ghtfg |stats count by host.
So my dashboard panel is displaying with multiple hosts as bar graph.
here i want to show each single host in different colours.

For example: in the dashboard panel if it is dsiplaying 4 hosts
1st host should display as red, 2nd host should display as green so on....

3.. i want to display the values on the graph, it is displaying but it is overlapping, how can make them display clearly.
if you see here all values are overlapping, i want this values should individually without overlapping.

[bowesmana]

If you are doing

search...
| stats count by host

then just add

| transpose 0 header_field=host column_name=Host

but that graph example you posted is not a count by host.

If you have two fields then you can use the chart command to get multi-series

search...
| chart count over X by Y

where Y will by the multi series that is shown in different colours

As for your overlapping values, with your non-rounded values, where you are displaying 13 decimal places, you should round those values - do you really need all 13 places??

| eval x=round(x,2)

will round to 2dp

[Ash1]

2. for the multi series colours : Please tell me what i should add so that i can get the different colours.
Here i am calculating the avg response time by host and code_desc.

i am using the below query :
index=xxxxx code_desc=NH23FG OR code_desc=TH45GH source=xxxx*
|stats avg(responsetime) as Avg_response by host, code_desc
|sort by Avg_response
|where Avg_response>500

Output:

3. i have rounded up the value upto 2 decimal places, now it is showing correctly, but if i want to show complete number upto 13 .
how can i do that??

[bowesmana]

For multi series colour, use

| chart avg(responsetime) as Avg_response over host by code_desc

rather than stats

If you want to show 13 decimal places for all values on the chart, then it will look like the messy chart you have.

[mahesh27]

when i am using chart no data is coming from the query.

| chart avg(responsetime) as Avg_response over host by code_desc

on e more point how can i mention the option name
<option name ="charting.fieldSeries">{xxxxxxxxx}</option>
please advise.

[bowesmana]

There will be no field Avg_response using chart, so you can put the chart line after your where clause

index=xxxxx code_desc=NH23FG OR code_desc=TH45GH source=xxxx*
| stats avg(responsetime) as Avg_response by host, code_desc
| where Avg_response>500
| sort by Avg_response
| chart values(Avg_response) as Avg_response over host by code_desc