Splunk Search

How to create a radio button for chart type?

chadman
Path Finder

I'm trying to create a radio button for chart type, but it's not working. All my charts are coming up column regardless of the radio button selection. Here is how I have the radio button setup.

   <input type="radio" token="charttype" searchWhenChanged="true">
      <label>Chart Type</label>

      <!-- Define the default value -->
      <default>Area</default>

      <!-- Hard-code the choices -->
      <choice value="column">Column</choice>
      <choice value="area">Area</choice>
      <choice value="line">Line</choice> 
    </input>

And I have the chart set up like this:

      <title>Internal Ping Time</title>
      <option name="charting.axisTitleX.text">Date</option>
       <option name="charting.axisTitleY.text">Ping Time (ms)</option>
      <option name="charting.chart">$charttype$</option>
      <option name="charting.primaryAxisTitle.text"/>
0 Karma
1 Solution

sundareshr
Legend

*UPDATED*

I don't believe you can do that. However, you can have three different panels, each with specific chart types and show/hide them based on user selection. Something like this

<input type="radio" token="charttype" searchWhenChanged="true">
    <label>Chart Type</label>

    <!-- Define the default value -->
    <default>Area</default>

    <!-- Hard-code the choices -->
    <choice value="column">Column</choice>
    <choice value="area">Area</choice>
    <choice value="line">Line</choice>
    <change>
        <condition label="Area">
            <set token="area"></set>
            <unset token="column"></unset>
            <unset token="line"></unset>
        </condition>
        <condition label="Column">
            <set token="column"></set>
            <unset token="area"></unset>
            <unset token="line"></unset>
        </condition>
        <condition label="Line">
            <set token="line"></set>
            <unset token="column"></unset>
            <unset token="area"></unset>
        </condition>
    </change>
</input>

.....
<row>
    <panel depends="$area$">
        <search>
            <query> ... | eval x="$area$" | ...
            </query>
        </search>
        <chart>
             <option name="charting.chart">Area</option>
        </chart>
    </panel>
    <panel depends="$line$">
        <search>
            <query> ... | eval x="$line$" | ...
            </query>
        </search>
        <chart>
             <option name="charting.chart">Line</option>
        </chart>
    </panel>
    <panel depends="$column$">
        <search>
            <query> ... | eval x="$column$" | ...
            </query>
        </search>
        <chart>
             <option name="charting.chart">Column</option>
        </chart>
    </panel>
</row>

The reason for the eval x=$area$ etc. in the query is to prevent that search from executing when not needed.

View solution in original post

0 Karma

sundareshr
Legend

*UPDATED*

I don't believe you can do that. However, you can have three different panels, each with specific chart types and show/hide them based on user selection. Something like this

<input type="radio" token="charttype" searchWhenChanged="true">
    <label>Chart Type</label>

    <!-- Define the default value -->
    <default>Area</default>

    <!-- Hard-code the choices -->
    <choice value="column">Column</choice>
    <choice value="area">Area</choice>
    <choice value="line">Line</choice>
    <change>
        <condition label="Area">
            <set token="area"></set>
            <unset token="column"></unset>
            <unset token="line"></unset>
        </condition>
        <condition label="Column">
            <set token="column"></set>
            <unset token="area"></unset>
            <unset token="line"></unset>
        </condition>
        <condition label="Line">
            <set token="line"></set>
            <unset token="column"></unset>
            <unset token="area"></unset>
        </condition>
    </change>
</input>

.....
<row>
    <panel depends="$area$">
        <search>
            <query> ... | eval x="$area$" | ...
            </query>
        </search>
        <chart>
             <option name="charting.chart">Area</option>
        </chart>
    </panel>
    <panel depends="$line$">
        <search>
            <query> ... | eval x="$line$" | ...
            </query>
        </search>
        <chart>
             <option name="charting.chart">Line</option>
        </chart>
    </panel>
    <panel depends="$column$">
        <search>
            <query> ... | eval x="$column$" | ...
            </query>
        </search>
        <chart>
             <option name="charting.chart">Column</option>
        </chart>
    </panel>
</row>

The reason for the eval x=$area$ etc. in the query is to prevent that search from executing when not needed.

0 Karma

chadman
Path Finder

Thanks and I tried that, but I get this error:

XML Syntax Error: Cannot find object mapper for panel type: panel

I'm using version 5 of Splunk.

0 Karma

sundareshr
Legend

See the updated version. The token name for the depends attributes needs be within $ symbols. Although I do not know if this will work in version 5.

0 Karma

chadman
Path Finder

I still get the same error, but we plan to upgrade to a newer version by the end of next month. I'll give it a try then. Thanks for the help. Chad

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI &#43; Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...