Splunk Search

Grouping multiple pie charts and adding them in the drop down menu

bollam
Path Finder

Hello,

I have a couple of dashboards which contains two pie charts of two nodes. I want to merge these dashboards into one. I want to group pie charts of one dashboard and put it in the drop down menu and similarly the other one.
For an instance: I want to group node1 and node2 to the value of dashboard1 and node3 and node4 to the value of dashboard2 in the dropdown. When I choose dashboard1 the piecharts of node1 and node2 should only be displayed. When I choose dashboard2 the piecharts of node3 and node4 should only be displayed.

Please find the source of one of my dashboards and the other dashboard content will also be similar to this.

<dashboard>
  <label>UsedVsAvailable</label>
  <row>
    <panel>
      <title>PieChart</title>
      <chart>
        <title>Node1</title>
        <search>
          <query>index=sai_core source="*size*" Name="Sai Kumar" | head 1
| eval ConsumedSpace = TotalSpace - AvailableSpace 
| table ConsumedSpace AvailableSpace 
| transpose</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <!--option name="width">50</option-->
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.showLabels">0</option>
        <option name="charting.chart.showPercent">0</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">left</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">250</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>AvailableVsTotal</title>
      <chart>
        <title>Node2</title>
        <search>
          <query>index=sai_core source="*size*" Name="Sai Kumar" | head 1
| eval ConsumedSpace = TotalSpace - AvailableSpace 
| table TotalSpace AvailableSpace
| transpose</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>
Tags (2)
0 Karma

harishalipaka
Motivator

Hi @bollam try below example

<form>
  <label>hideshow</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selected" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="dashboard1">dashboard1</choice>
      <choice value="dashboard2">dashboard2</choice>
      <default>dashboard1</default>
      <change>
        <condition value="dashboard1">
          <set token="dashboard1"></set>
          <unset token="dashboard2"></unset>
        </condition>
        <condition value="dashboard2">
          <unset token="dashboard1"></unset>
          <set token="dashboard2"></set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$dashboard1$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node1</title>
        <search>
          <query>|makeresults |eval tokenvalue=20 |append [|makeresults |eval tokenvalue=50]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$dashboard1$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node2</title>
        <search>
          <query>|makeresults |eval tokenvalue=10 |append [|makeresults |eval tokenvalue=80]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$dashboard2$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node3</title>
        <search>
          <query>|makeresults |eval tokenvalue=50 |append [|makeresults |eval tokenvalue=40]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$dashboard2$">
      <title>|stats count by $selected$</title>
      <chart>
        <title>Node4</title>
        <search>
          <query>|makeresults |eval tokenvalue=28 |append [|makeresults |eval tokenvalue=70]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Thanks
Harish

bollam
Path Finder

Awesome! It worked for me.. Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...