Daniel Spavin
daniel@spavin.net
I am a Splunk Professional Services consultant working for JDS Australia (https://www.jds.net.au), in Melbourne Australia.

Version Support

8.0, 7.3, 7.2, 7.1, 7.0, 6.6

Who is this app for?

This app is for dashboard designers who want to compactly display parent-child relationships in their data.

How does the app work?

This app provides a visualization that you can use in your own apps and dashboards.

To use it in your dashboards, simply install the app, and create a search that provides the values you want to display.

Usecases for the Tree View Visualization: * Grouping categories together, e.g. sourcetypes by host * Providing a compact interface for generating tokens for drill-downs in a dashboard * Creating a menu in a set of dashboards * Visualizing the layout of files, running process, or perfmon stats on multiple hosts

The following fields can be used in the search: * id (required): An identifier for the lable. Use this value when assigning child items. Will default to the label if not supplied. * label (required): The value shown next to the item. * parentid (optional): Sets the parent item based on id. Will create a parent folder with the same label as the ID if one doesn't already exist. * iconFolder (optional): When using "custom" style, selects icon for folders. * iconDoc (optional): When using "custom" style, selects icon for child items.

Example Search

index=_internal
| stats count by sourcetype, source
| rename source as id, sourcetype as parentId
| eval label = id
| table id, label, parentId

Tokens

Tokens are generated each time you click an item. This can be useful if you want to populate another panel on the dashboard with a custom search, or link to a new dashboard with the tokens carying across.

Label text : This is the display name of the selected item. Default value: $tv_label_token$
ID : This is the value of the selected group you clicked. Default value: $tv_id_token$
Parent ID : This is the value of the selected group you clicked. Default value: $tv_parent_id_token$

The following standard Splunk drill-down tokens are also generated:

row.label : The Label text
row.id : The ID
row.parentid : The parent ID
row.<fieldname> : the field "fieldname" from the search results.

Release Notes

v 1.1.0 * New option to have all folders open when the visualization starts. Options - General - Initial State = Closed / Open, Based on user request * Added app manifest for Splunk Cloud * Fixed some issues with drill-downs * AppInspect now passes

v 1.0.0 * Initial version

Issues and Limitations

If you have a bug report or feature request, please contact daniel@spavin.net

Privacy and Legal

No personally identifiable information is logged or obtained in any way through this visualizaton.

For support

Send email to daniel@spavin.net

Support is not guaranteed and will be provided on a best effort basis.

3rd Party Libraries

FancyTree

Icons made by FontAwesome