Splunk Search

customize the chart display on selecting value from static multiselect option

vikashperiwal
Path Finder

HI,

I am trying to implement customized chart views, to state the issue

I have static multi select input with token "host" with ALL has a value., the query has time chart some thing

| timechart span=15m avg(a1) as "session_current" by host ,

now when ALL is selected from multi select input i see all the host in the legends in chart that ALL has, but instead of showing the values i want to show only "WEST" in the chart legends

0 Karma

to4kawa
Ultra Champion

sample( index=_internal😞

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="sourcetype">ALL</choice>
      <choice value="&quot;WEST&quot;">WEST</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal
| eval sourcetype=$field1$
| timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

vikashperiwal
Path Finder

Here s some confusion, let me explain more on my issue

Multiselect

    <label>West Node</label>
    <choice value="ABBRLW-SPGW-05">ALL</choice>
  </input>

Query:
index=cisco_asr5k_bulkstats sourcetype="cisco:asr5k:spgw:apn:apnSch2" apn ="ctracker.telus.iot" schema_type=apn host IN ($tok_west_sess$) sess_curr=*

| timechart span=$timeresolution$ avg(a1) as "session_current" by host

So when All is selected from multiselect , chart i dont want to show the host name "ABBRLW-SPGW-05" but a dummay value "West" to be displayed

0 Karma

to4kawa
Ultra Champion
....
|rename ABBRLW-SPGW-05 as West

append finally.

0 Karma

vikashperiwal
Path Finder

this is my multiselect

    <label>East Node</label>
    <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
    <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
    <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
    <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>
  </input>

when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma

to4kawa
Ultra Champion

The dashboard won't work with the information you're presenting.
There is not token.

0 Karma

vikashperiwal
Path Finder

Here it is

    <label>West</label>
 <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
 <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
 <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
 <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>

This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for
when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...