Splunk Search
Highlighted

Multicharts on dashboard

Explorer

Hello-

Right now I'm trying to figure out how I could put multicharts on dashboard if I have two objects given:
A list of host (1 column), and a script that takes in the name of one host and make a chart out of it.

If I were to loop through the process of putting every host in a list through the script and chart it out and put them on dashboard,
How could I accomplish this in a wiser way than to hardcode it? (50+ hosts in a list)

Thank you for your time,
Jack

Tags (2)
0 Karma
Highlighted

Re: Multicharts on dashboard

Builder

I'm not seeing enough details to make a solid recommendation on what your trying to do, but in general you can chart by some value such as this which will place multiple lines on the chart;

<search terms> | chart count by value

Your "value" in this case sounds like it is your hosts, but I don't see what metric you are trying to display per host. There are many functions you could put in there, for instance "avg(cpu)" or "max(time_taken)". I just don't see what you are measuring.

Ref: http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Chart

0 Karma
Highlighted

Re: Multicharts on dashboard

Explorer

Hello, sorry for the lack of details.
I meant to say that I need an individual chart for every host. And for each host, the information is extracted by a python script which I timechart it.
So, I want a dashboard of 50 individual charts.. each one for different host.

but I only have a list of hosts and a python script. For example,

| lppy disk HOSTNAME | timechart usedmb

would give me a single chart for a host.

But If I were to repeat this for every host on the list I have, I can't think of any other methods than to hardcode.

Do you have any idea?

0 Karma
Highlighted

Re: Multicharts on dashboard

SplunkTrust
SplunkTrust

This should be achievable in JS/HTML dashboards. Basically, run your Python script in an invisible SearchManager, listen to its search:done event, read results, loop over results creating SearchManager objects and their associated charts using your hosts.

This might not be terribly efficient, launching 50 searches for 50 hosts. It'd be better to run one search with a list of those 50 hosts and then pick the results apart for display - depends on too many variables whether this is feasible or not.

View solution in original post

0 Karma