I am using Splunk cloud version 9.0.2208.1 The source for the multiselect button: "input_dhtiWnl4": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "Task_Name_Filter",
"defaultValue": [
"*"
]
},
"title": "Daily Task Name Selection",
"type": "input.multiselect",
"dataSources": {
"primary": "ds_tapmtJKf"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All Tasks"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"ShortName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"Win_Task_Name\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
}, The datasource for this input: "ds_tapmtJKf": {
"type": "ds.search",
"options": {
"query": "index=PRO-WINTSK-* Win_Task_Name=\"\\\\PRD*\" NOT Win_Task_Name IN (\"\\\\PRD\\\\Xofin.Schedule.Invoicing.Run\", \"\\\\PRD\\\\Xofin.Schedule.Admin.SendDocuments2\", \"\\\\PRD\\\\Xofin.Schedule.Planning.AutoPlanningMed\", \"\\\\PRD\\\\Xofin.Schedule.Planning.SendConvocation\", \"\\\\PRD\\\\Xofin.Schedule.Seed.CreateMedicalFile\", \"\\\\PRD\\\\Xofin.Schedule.Admin.Efficient51\", \"\\\\PRD\\\\Xofin.Schedule.UploadToVaccinet*\")\n | transaction InstanceId \n | stats latest_time(duration) as LastRun by Win_Task_Name \n| eval ShortName=replace(Win_Task_Name, \"\\\\\\PRD\\\\\\Xofin\\\\.Schedule\\\\.\",\"\")\n | sort LastRun desc\n | fields Win_Task_Name ShortName",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"name": "TaskNames"
} And the code for a table: How should i go a about setting the drilldown when i rename the column i want the value from to something with a space as shown below? "viz_table_1": {
"type": "splunk.table",
"options": {
"count": 25,
"dataOverlayMode": "none",
"drilldown": "none",
"percentagesRow": false,
"rowNumbers": false,
"totalsRow": false,
"wrap": true,
"headerVisibility": "fixed",
"columnFormat": {
"Average Run Tim (s)": {
"data": "> table | seriesByName(\"Average Run Tim (s)\") | formatByType(Average_Run_Tim__s_ColumnFormatEditorConfig)",
"width": 180.58333333333334
},
"Latest Run Time (s)": {
"data": "> table | seriesByName(\"Latest Run Time (s)\") | formatByType(Latest_Run_Time__s_ColumnFormatEditorConfig)"
},
"Deviation in %": {
"data": "> table | seriesByName(\"Deviation in %\") | formatByType(Deviation_in__ColumnFormatEditorConfig)",
"rowColors": "> table | seriesByName(\"Deviation in %\") | rangeValue(Deviation_in__RowColorsEditorConfig)"
},
"Win_Task_Name": {
"width": 436
},
"Trend of Run Time": {
"width": 486.66666666666663
},
"# of Runs": {
"width": 116.77777777777777
},
"Latest Start Time": {
"width": 184.16666666666669
}
}
},
"dataSources": {
"primary": "ds_search_1"
},
"title": "Task Run Times",
"context": {
"Average_Run_Tim__s_ColumnFormatEditorConfig": {
"number": {
"thousandSeparated": false,
"unitPosition": "after",
"precision": 2,
"unit": "s"
}
},
"Latest_Run_Time__s_ColumnFormatEditorConfig": {
"number": {
"thousandSeparated": false,
"unitPosition": "after",
"unit": "s",
"precision": 2
}
},
"Deviation_in__ColumnFormatEditorConfig": {
"number": {
"thousandSeparated": false,
"unitPosition": "after",
"unit": "%",
"precision": 2
}
},
"Deviation_in__RowColorsEditorConfig": [
{
"value": "#da3b30",
"to": -80
},
{
"value": "#a0312e",
"from": -80,
"to": -40
},
{
"value": "#252214",
"from": -40,
"to": 0
},
{
"value": "#252214",
"from": 0,
"to": 40
},
{
"value": "#a0312e",
"from": 40,
"to": 80
},
{
"value": "#DA3B30",
"from": 80
}
]
},
"description": "Overview of all daily Windows Jobs",
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"token": "Task_Name_Filter",
"key": "row.Win_Task_Name.value"
}
]
}
}
]
}, Datasource for this table: "ds_search_1": {
"type": "ds.search",
"options": {
"query": "index=$Env$-WINTSK-* Win_Task_Name=\"\\\\PRD*\" NOT Win_Task_Name IN (\"\\\\PRD\\\\Xofin.Schedule.Invoicing.Run\", \"\\\\PRD\\\\Xofin.Schedule.Admin.SendDocuments2\", \"\\\\PRD\\\\Xofin.Schedule.Planning.AutoPlanningMed\", \"\\\\PRD\\\\Xofin.Schedule.Planning.SendConvocation\", \"\\\\PRD\\\\Xofin.Schedule.Seed.CreateMedicalFile\", \"\\\\PRD\\\\Xofin.Schedule.Admin.Efficient51\", \"\\\\PRD\\\\Xofin.Schedule.UploadToVaccinet*\") Win_Task_Name IN ($Task_Name_Filter|s$)\n| transaction InstanceId \n| stats avg(duration) as AvgDur sparkline(avg(duration)) as DurTrend count as Runs latest_time(duration) as LastRun latest(duration) as LastRunTime by Win_Task_Name\n| eval LastRun=strftime(LastRun, \"%d %B %Y %H:%M\")| eval Devi=((LastRunTime - AvgDur)/AvgDur)*100 \n\n| eval LastRunTime=tostring(LastRunTime, \"duration\")\n| eval AvgDur=tostring(round(AvgDur, 2), \"duration\")\n| sort Devi desc | rename Devi as \"Deviation in %\", LastRun as \"Latest Start Time\" LastRunTime as \"Latest Run Time (s)\", AvgDur as \"Average Run Tim (s)\", Runs as \"# of Runs\", DurTrend as \"Trend of Run Time\", Win_Task_Name as \"Task Name\"",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"name": "TaskRunTimes"
}, Chart using the same token and a drilldown: "viz_chart_1": {
"type": "splunk.line",
"dataSources": {
"primary": "ds_search_1_new"
},
"title": "Most recent Tasks",
"options": {
"yAxisAbbreviation": "auto",
"y2AxisAbbreviation": "auto",
"showRoundedY2AxisLabels": false,
"legendTruncation": "ellipsisStart",
"showY2MajorGridLines": true,
"xAxisLabelRotation": 0,
"xAxisTitleText": "Time",
"xAxisTitleVisibility": "show",
"yAxisTitleVisibility": "show",
"y2AxisTitleVisibility": "show",
"yAxisScale": "linear",
"showOverlayY2Axis": 0,
"y2AxisScale": "inherit",
"dataValuesDisplay": "all",
"showSplitSeries": 0,
"showIndependentYRanges": 0,
"legendMode": "standard",
"lineWidth": 2,
"nullValueDisplay": "connect",
"yAxisTitleText": "Duration (s)"
},
"description": "Duration of the most recent tasks",
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"token": "Task_Name_Filter",
"key": "name"
}
]
}
}
]
}, Datasource for this chart: "ds_search_1_new": {
"type": "ds.search",
"options": {
"query": "index=$Env$-WINTSK-* \n [ search index=$Env$-WINTSK-* Win_Task_Name=\"\\\\PRD*\" NOT Win_Task_Name IN (\"\\\\PRD\\\\Xofin.Schedule.Invoicing.Run\", \"\\\\PRD\\\\Xofin.Schedule.Admin.SendDocuments2\", \"\\\\PRD\\\\Xofin.Schedule.Planning.AutoPlanningMed\", \"\\\\PRD\\\\Xofin.Schedule.Planning.SendConvocation\", \"\\\\PRD\\\\Xofin.Schedule.Seed.CreateMedicalFile\", \"\\\\PRD\\\\Xofin.Schedule.Admin.Efficient51\", \"\\\\PRD\\\\Xofin.Schedule.UploadToVaccinet*\") Win_Task_Name IN ($Task_Name_Filter|s$) \n | transaction InstanceId \n | stats latest_time(duration) as LastRun by Win_Task_Name \n | sort 5 LastRun desc\n | fields Win_Task_Name]\n| transaction InstanceId\n| timechart span=1d avg(duration) by Win_Task_Name useother=f",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"name": "RecentTaskGraph"
},
... View more
