Dashboards & Visualizations

Select field with highest value within single event for a dashboard panel

emirhand
New Member

Hi all,

I'm trying to get the hang of Splunk and was stuck somewhere (who wasn't? :). I did search other topics to no avail.

I have events that contain stats from more than one device in a system, such as a bunch of battery voltages. Sample fields from an event could be:
Timestamp, BAT0Voltage, BAT1Voltage, BAT2Voltage, BAT3Voltage

I'm trying to include the BATxVoltage field with the largest value in a dashboard single-value panel. So I would see 566 Volts in the panel for the following sample event:
$Timestamp, 566, 543, 512, 499

But the dashboard would show 593 from this one:
$Timestamp, 566, 543, 593, 496

See, BAT0Voltage was selected in the first event, but BAT2Voltage is selected in the second as it has the largest value in a string of fields.

Thanks in advance to anyone with any ideas (working or not!).

0 Karma
1 Solution

jnudell_2
Builder

Hi @emirhand ,
The answer provided by @richgalloway works and provides a table of maximum values. However, if you're looking for a single value for a particular device to display on a dashboard, you might try this:

| makeresults 
| eval _time=now(), device="UPS001", BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593
| stats latest(BAT*) as BAT* by device
| where device="UPS001"
| table BAT*
| transpose
| stats max("row 1") as MaxVoltage

In the above example, I'm creating a dummy event for a device called UPS001 with 4 battery voltage values. We run a stats to get the most recent value for all devices, then we filter to a specific device (UPS001 in this case). After that we use a transpose command to line all the fields up in a column so that we can run a simple stats command to get the maximum value for the UPS001 device.
alt text

View solution in original post

0 Karma

emirhand
New Member

Thank you both. I think answer by @jnudell_2 fits better for my purposes, and @richgalloway's answer is archived to use for a better fit in the future. 🙂

0 Karma

jnudell_2
Builder

Hi @emirhand ,
The answer provided by @richgalloway works and provides a table of maximum values. However, if you're looking for a single value for a particular device to display on a dashboard, you might try this:

| makeresults 
| eval _time=now(), device="UPS001", BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593
| stats latest(BAT*) as BAT* by device
| where device="UPS001"
| table BAT*
| transpose
| stats max("row 1") as MaxVoltage

In the above example, I'm creating a dummy event for a device called UPS001 with 4 battery voltage values. We run a stats to get the most recent value for all devices, then we filter to a specific device (UPS001 in this case). After that we use a transpose command to line all the fields up in a column so that we can run a simple stats command to get the maximum value for the UPS001 device.
alt text

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This run-anywhere example shows one way to do that.

| makeresults annotate=t | eval BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593 | eval MaxVoltage=0 | foreach BAT*Voltage [eval MaxVoltage=if('<<FIELD>>' > MaxVoltage, '<<FIELD>>', MaxVoltage)] | table MaxVoltage
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...