Splunk Search

How to create multiple values in time chart based on dropdown menu token?

jialiu907
Path Finder

I am looking to have a time chart table that has a dropdown menu based on a token,  be able to show all of the values of the dropdown menu in its first option and have it displayed as the default. Each value only shows one line, and I'm looking for all of the lines to populate the chart in the All selection.

This is my current time chart.

jialiu907_0-1684855779358.png

This is the current values based on the token. 

jialiu907_1-1684855871959.png

This is the current search.

 

index=main host=$token$* sourcetype=syslog process=elcsend "\"config " CentOS 
| rex "([^!]*!){2}(?P<type>[^!]*)!([^!]*!){4}(?P<role>[^!]*)!([^!]*!){23}(?P<vers>[^!]*)"  
| search role=std-dhcp
| eval location=$token|s$
| timechart span=1d count by location

 

 

If unable to do that, I am also open to the option of removing the dropdown menu and only having the default time chart showcasing all of the values.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If location is always the first 4 characters of host, then use this

| eval location=substr(host,0,4)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If location is always the first 4 characters of host, then use this

| eval location=substr(host,0,4)

jialiu907
Path Finder

Thank you so much, that worked perfectly!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...