Refine your search:

0
1

I'm trying to create a dashboard with a bunch of 'traffic light' style indicators for stats like CPU load, memory use, free disk space, using the *NIX app to collect the data for me. The idea is then to be able to click on any of those indicators and get a graph for how that statistic has varied over the last 12 hours.

I'm just trying to get CPU Load working at the moment, and this is what i have so far. Please excuse typos because i'm manually typing from another system...

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">index=os sourcetype=vmstat host=* | multikv fields host loadAvg1mi | rangemap field=loadAvg1mi low=0-1 elevated=1-2 severe=2-99 default=severe | fields range loadAvg1mi</param>
  <param name="earliest">-1m@m</param>
  <param name="latest">now</param>
  <module name="ViewStateAdapter">
    <module name="HiddenFieldPicker">
      <param name="strictMode">True</param>
      <module name="JobProgressIndicator">
        <module name="SingleValue">
          <param name="classField">range</param>
          <module name="HiddenSearch">
            <param name="search">index=os sourcetype=vmstat host=* | multikv fields host loadAvg1mi | timechart span=1m max(loadAvg1mi) by host</param>
            <param name="earliest">-12h</param>
            <module name="JobProgressIndicator"></module>
            <module name="HiddenChartFormatter">
              <param name="chart">line</param>
              <module name="FlashChart">
                <param name="width">100%</param>
                <param name="height">250px</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

If i remove the <module name="HiddenSearch"> and everything underneath it, i get my nice colour coded SingleValue. If i reintroduce the HiddenSearch then I get the following message at the top of the page:

This view has a Splunk.Module.SingleValue module configured to push changes to downstream modules. This module never has any changes to push so this represents a configuration error.

and the page itself just displays the line graph that i hoped would only appear when the SingleValue was clicked.

Clearly I'm doing something wrong and trying to make SingleValue do something it shouldn't, but I'm quite stuck as to how to proceed from here.

Any tips would be greatly appreciated!

Cheers, Phil

asked 22 Jul '11, 07:25

philclapham's gravatar image

philclapham
111
accept rate: 0%


One Answer:

I think you can't drilldown from a SingleValue module in the way you're looking for. Take a look at this question: Drilldown link in dashboard on Splunk Answers

It might be a long road to walk, but you can probably get what you need by crafting your search into a simpleresultstable with the columns CPU, Disk, etc., so you can drilldown that way. It's much less visually attractive, though, obviously.

This might also help you get where you need to go (though it uses Sideview Utils, which is very valuable, but takes some time to learn): How to use Redirector with SingleValue on Splunk Answers

link

answered 22 Jul '11, 09:34

David's gravatar image

David
2.2k1320
accept rate: 46%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×192
×105
×58

Asked: 22 Jul '11, 07:25

Seen: 1,100 times

Last updated: 22 Jul '11, 09:34

Copyright © 2005-2012 Splunk Inc. All rights reserved.