Telling Splunk to decide which type of chart to use depending on incoming data

[watsm10]

I have a view with multiple drop downs. You can select the service and then the users which are related with that service. I have the response times of the users in a 100% stacked column chart, but when I select a single user from the drop down menu I want the chart to automatically change to a pie chart as it is a better way of displaying the response time for a single user.

Can anyone suggest a way using advanced XML to tell Splunk to automatically change the chart type if the number of users denoted by $userToken$ is equal to 1?

Many thanks.

[neelamssantosh]

Hope "intentions" concept can help you..

name="HiddenSearch"
layoutPanel="panel_row1_col1"
autoRun="True">

[sideview]

Sure. I would certainly use Sideview Utils to do this because without it you would have to write and maintain a bunch of custom javascript yourself.

So download Sideview Utils. the app contains its own documentation and configuration examples and you should read them all, or at the very least read the first few pages of documentation carefully.

By the way, if you haven't switched to the Advanced XML already, you'll have to do that too.

What I would do is use a PostProcess module, with a little eval and a little rename, to create a field called "chart.chartType", whose values are the correct chartType, and then use the ResultsValueSetter module to pull that field value down to the client and turn it into a $foo$ token. It's a strange trick but a powerful one. Here's what it looks like:

<your existing search modules etc...>

  <!-- creates a field "chart.chartType". The value will be pie or bar, as appropriate -->
  <module name="PostProcess">
    <param name="search">| stats dc(userName) as numberOfUsers | eval chartType=if(numberOfUsers=="1","pie","bar") | rename chartType as "chart.chartType"</param>

    <!-- does the strange work of pulling the field down to the UI as $chart.chartType$ -->
    <module name="ResultsValueSetter">
      <param name="fields">chart.chartType</param>

      <!-- necessary to bleach away the PostProcess so that the FlashChart doesn't 
           use it when requesting results -->
      <module name="PostProcess">
        <param name="search"> </param>

        <!-- That's it. The FlashChart will see the chart.chartType key, and will 
             react accordingly -->
        <module name="FlashChart"></module>
      </module>
    </module>
  </module>
</module>