Splunk Search

How to create multiple values in time chart based on dropdown menu token?

jialiu907
Path Finder

I am looking to have a time chart table that has a dropdown menu based on a token,  be able to show all of the values of the dropdown menu in its first option and have it displayed as the default. Each value only shows one line, and I'm looking for all of the lines to populate the chart in the All selection.

This is my current time chart.

jialiu907_0-1684855779358.png

This is the current values based on the token. 

jialiu907_1-1684855871959.png

This is the current search.

 

index=main host=$token$* sourcetype=syslog process=elcsend "\"config " CentOS 
| rex "([^!]*!){2}(?P<type>[^!]*)!([^!]*!){4}(?P<role>[^!]*)!([^!]*!){23}(?P<vers>[^!]*)"  
| search role=std-dhcp
| eval location=$token|s$
| timechart span=1d count by location

 

 

If unable to do that, I am also open to the option of removing the dropdown menu and only having the default time chart showcasing all of the values.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If location is always the first 4 characters of host, then use this

| eval location=substr(host,0,4)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If location is always the first 4 characters of host, then use this

| eval location=substr(host,0,4)

jialiu907
Path Finder

Thank you so much, that worked perfectly!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...