Dashboards & Visualizations

How to create a dashboard with a Single Value visualization for each hostname?

jeffbat
Path Finder

I have a pivot table that has countervalues with a time value and hostname. I am trying to make a dashboard that will show the values using Single Value but one single value for each hostname.

This is the search:

| pivot Capacity_Planning_Pivot__Test CapcityCounters count(CapcityCounters) AS "count(CapcityCounters)" SPLITROW _time AS _time PERIOD day SPLITROW Path AS Path SPLITROW AverageValue AS AverageValue FILTER Path contains WEBSVC SORT 5000 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 | fields - "count(CapcityCounters)" | timechart span=7d avg(AverageValue) by Path

(path is the hostname and it goes back for 1 month broken up into 7 day increments so that I can get a trendline)

Doing this directly will show a table with time on the left for rows and hostname on top for columns. But if I change it to a visualization of Single Value, I only get the first hostname column value and the trend is just based off that one. Which would be fine if I could get a single value box for each of the different columns.

Is there anyway to do this?

Thanks.

lguinn2
Legend

There is no way to do this directly. But you could use your search as a base search, and then have a post-process search for each Single Value panel that simply selects one of the result columns from the base search. It isn't going to be very dynamic though: you will have to pre-determine the various hosts.

Here is a link to the documentation for base searches and post-process searches.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...