I am trying to repeat line chart for multiple host selection. Each line chart should display the cpu usage for each selected hosts separately. Here is my full source code in Dashboard studio. {
...
See more...
I am trying to repeat line chart for multiple host selection. Each line chart should display the cpu usage for each selected hosts separately. Here is my full source code in Dashboard studio. {
"visualizations": {
"viz_gsqlcpsd": {
"type": "splunk.line",
"dataSources": {
"primary": "ds_xcdWhjuu"
},
"title": "${selected_server:-All Servers} - CPU Usage %"
}
},
"inputs": {
"input_VtWuBSik": {
"options": {
"items": [
{
"label": "All",
"value": "*"
},
{
"label": "host123",
"value": "host123"
},
{
"label": "host1234",
"value": "host1234"
}
],
"defaultValue": [
"*"
],
"token": "selected_server"
},
"title": "server",
"type": "input.multiselect"
},
"input_mj9iUMvw": {
"options": {
"defaultValue": "-15m,now",
"token": "tr_hMOOrvcD"
},
"title": "Time Range Input Title",
"type": "input.timerange"
}
},
"layout": {
"type": "grid",
"globalInputs": [
"input_VtWuBSik",
"input_mj9iUMvw"
],
"options": {
"backgroundColor": "transparent"
},
"structure": [
{
"item": "viz_gsqlcpsd",
"type": "repeating",
"repeatFor": {
"input": "input_VtWuBSik"
},
"position": {
"x": 0,
"y": 0,
"w": 1200,
"h": 400
}
}
]
},
"dataSources": {
"ds_xcdWhjuu": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
},
"query": "index=host_metrics measurement=cpu_time \r\n| search url IN($selected_server$) OR url=\"default_server\"\r\n| eval state_filter=if(match(state, \"^(idle|interrupt|nice|softirq|steal|system|user|wait)$\"), 1, 0)\r\n| where state_filter = 1\r\n| sort 0 _time url cpu state\r\n| streamstats current=f last(counter) as prev by url cpu state\r\n| eval delta = counter - prev\r\n| where delta >= 0\r\n| bin _time span=1m\r\n| eventstats sum(delta) as total by _time, url, cpu\r\n| eval percent = round((delta / total) * 100, 2)\r\n| eval url_state = url . \"_\" . state \r\n| timechart span=1m avg(percent) by url_state\r\n| foreach * [eval <<FIELD>> = round('<<FIELD>>', 2)]"
},
"name": "CPU_Util_Search_1"
}
},
"title": "Test_Multi Line chart"
}