Splunk Search

Is there a way to dynamically assign chart labels using a search?

mszebenyi_splun
Splunk Employee
Splunk Employee

Is there a way to dynamically assign chart labels using a search? My search ends with a timechart values(foo) as bar, values(baz) as qux. I have created searches to pull out the values from Splunk for the labels, but if I replace "bar" and "qux" as subsearches, the labels get a bit missed up and the chart data skews. My current environment is Splunk Enterprise 6.4 and 6.3. What am I missing? Thanks!

1 Solution

somesoni2
Revered Legend

Try something like this (run anywhere sample). Here I'm setting the token in the search element to dynamically get the renamed column name.

<dashboard>
  <label>Dynamic_Chart Label</label>
  <search>
    <query>| gentimes start=-1 | eval splunkd="\"Splunk Engine\"" | eval splunk_web_access="\"Splunk Web\""| table splunkd splunk_web_access</query>
    <finalized>
      <condition>
        <set token="splunkd">$result.splunkd$</set>
        <set token="splunk_web_access">$result.splunk_web_access$</set>
      </condition>
    </finalized>
  </search>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd OR sourcetype=splunk_web_access | timechart count by sourcetype | rename splunkd as $splunkd$ splunk_web_access as $splunk_web_access$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>       
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

somesoni2
Revered Legend

Try something like this (run anywhere sample). Here I'm setting the token in the search element to dynamically get the renamed column name.

<dashboard>
  <label>Dynamic_Chart Label</label>
  <search>
    <query>| gentimes start=-1 | eval splunkd="\"Splunk Engine\"" | eval splunk_web_access="\"Splunk Web\""| table splunkd splunk_web_access</query>
    <finalized>
      <condition>
        <set token="splunkd">$result.splunkd$</set>
        <set token="splunk_web_access">$result.splunk_web_access$</set>
      </condition>
    </finalized>
  </search>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd OR sourcetype=splunk_web_access | timechart count by sourcetype | rename splunkd as $splunkd$ splunk_web_access as $splunk_web_access$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>       
      </chart>
    </panel>
  </row>
</dashboard>

somesoni2
Revered Legend

What version of Splunk you're using?

0 Karma

mszebenyi_splun
Splunk Employee
Splunk Employee

Splunk Enterprise 6.4 and 6.3.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...