Splunk Search

Passing checkbox values to timechart

vaishnavi07
Explorer

Hi i am using checkboxes module with sideview. I have to pass the values that i select in checkbox drand display graph for that. If i select "%_Processor_Time" then i should get graph displaying avg(%_Processor_Time). If i select two option like %_Processor_Time and %_DPC_Time then graph should get displayed for both.

For now the the query is getting passed like this.

search index=winserver_perf sourcetype="PerfmonMk:Processor" host="adwas1701" | timechart avg(Avg(%_Processor_Time))

If i select two option in checkbox then query looks like this.

index=winserver_perf sourcetype="PerfmonMk:Processor" host="adwas1701" | timechart avg(Avg(%_Processor_Time),Avg(%_DPC_Time))

There are two avg's getting passed in query. I dunno how to remove that.

                  <module name="Checkboxes" layoutPanel="panel_row2_col2">
        <param name="name">column</param>
        <param name="valueField">column</param>
        <param name="labelField">label</param>
        <param name="separator">,</param> 
        <param name="template">Avg($value$)</param>
        <param name="outerTemplate">$value$</param>  


                <module name="Search" layoutPanel="panel_row2_col1" autoRun="False">
                  <param name="search"> index=winserver_perf sourcetype="PerfmonMk:$sourcetype$" host="$host$"  | timechart avg($column$) </param>
                  <module name="JobProgressIndicator" /> 
                 <module name="ValueSetter" >

right
line
Time

$statistic$($column$)
$host$ : $sourcetype$ : $column$

connect

300px
100%



Can anyone please help me in finding out what is the mistake in the above code? Thanks in advance!

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Remove the avg() around your $column$ in the search.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As it is now, you have two avg() wrapped inside each other. One is here:

... | timechart avg($column$) 

And the other is here:

<param name="template">Avg($value$)</param>

Resulting in this:

| timechart avg(Avg(%_Processor_Time),Avg(%_DPC_Time))

What you want is this:

... | timechart $column$

and this:

<param name="template">avg($value$)</param>

Resulting in this:

| timechart avg(%_Processor_Time),avg(%_DPC_Time)
0 Karma

vaishnavi07
Explorer

If i remove the Avg() then its showing error as func() is needed for timechart.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...