Splunk Search

customize the chart display on selecting value from static multiselect option

vikashperiwal
Path Finder

HI,

I am trying to implement customized chart views, to state the issue

I have static multi select input with token "host" with ALL has a value., the query has time chart some thing

| timechart span=15m avg(a1) as "session_current" by host ,

now when ALL is selected from multi select input i see all the host in the legends in chart that ALL has, but instead of showing the values i want to show only "WEST" in the chart legends

0 Karma

to4kawa
Ultra Champion

sample( index=_internal😞

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="sourcetype">ALL</choice>
      <choice value="&quot;WEST&quot;">WEST</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal
| eval sourcetype=$field1$
| timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

vikashperiwal
Path Finder

Here s some confusion, let me explain more on my issue

Multiselect

    <label>West Node</label>
    <choice value="ABBRLW-SPGW-05">ALL</choice>
  </input>

Query:
index=cisco_asr5k_bulkstats sourcetype="cisco:asr5k:spgw:apn:apnSch2" apn ="ctracker.telus.iot" schema_type=apn host IN ($tok_west_sess$) sess_curr=*

| timechart span=$timeresolution$ avg(a1) as "session_current" by host

So when All is selected from multiselect , chart i dont want to show the host name "ABBRLW-SPGW-05" but a dummay value "West" to be displayed

0 Karma

to4kawa
Ultra Champion
....
|rename ABBRLW-SPGW-05 as West

append finally.

0 Karma

vikashperiwal
Path Finder

this is my multiselect

    <label>East Node</label>
    <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
    <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
    <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
    <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>
  </input>

when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma

to4kawa
Ultra Champion

The dashboard won't work with the information you're presenting.
There is not token.

0 Karma

vikashperiwal
Path Finder

Here it is

    <label>West</label>
 <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice>
 <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice>
 <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice>
 <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice>

This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for
when ALL is selected , instead of showing the values in chart it should show "WEST",

Only for ALL it should show value as "WEST"

| timechart span=15m avg(a1) as "session_current" by host

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...