Splunk Search

customize the chart display on selecting value from static multiselect option

vikashperiwal
Path Finder

HI,

I am trying to implement customized chart views, to state the issue

I have static multi select input with token "host" with ALL has a value., the query has time chart some thing

| timechart span=15m avg(a1) as "session_current" by host ,

now when ALL is selected from multi select input i see all the host in the legends in chart that ALL has, but instead of showing the values i want to show only "WEST" in the chart legends

0 Karma

to4kawa
Ultra Champion

sample( index=_internal😞

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="sourcetype">ALL</choice>
      <choice value="&quot;WEST&quot;">WEST</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal
| eval sourcetype=$field1$
| timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

vikashperiwal
Path Finder

Here s some confusion, let me explain more on my issue

Multiselect

    <label>West Node</label>
    <choice value="ABBRLW-SPGW-05">ALL</choice>
  </input>

Query:
index=cisco_asr5k_bulkstats sourcetype="cisco:asr5k:spgw:apn:apnSch2" apn ="ctracker.telus.iot" schema_type=apn host IN ($tok_west_sess$) sess_curr=*

| timechart span=$timeresolution$ avg(a1) as "session_current" by host

So when All is selected from multiselect , chart i dont want to show the host name "ABBRLW-SPGW-05" but a dummay value "West" to be displayed

0 Karma

to4kawa
Ultra Champion
....
|rename ABBRLW-SPGW-05 as West

append finally.

0 Karma

vikashperiwal
Path Finder

this is my multiselect

    <label>East Node</label>
    <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
    <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
    <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
    <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>
  </input>

when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma

to4kawa
Ultra Champion

The dashboard won't work with the information you're presenting.
There is not token.

0 Karma

vikashperiwal
Path Finder

Here it is

    <label>West</label>
 <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
 <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
 <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
 <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>

This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for
when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...