Splunk Search

How can I combine 2 search strings onto 1 dashboard?

dhardingatn
New Member

I have 2 search strings that I am trying to combine to put on one dashboard.

sourcetype=snmp_ta host=* | eval fuel=case(ppscFuelLevel > 10000, 0, 1=1, ppscFuelLevel), FuelPct = fuel/100 | stats latest(FuelPct) 

and

sourcetype=snmp_ta host=* | eval fuel=case(fuelLevel > 10000, 0, 1=1, fuelLevel), FuelPct = fuel/100 | stats latest(FuelPct)

These strings are from different generators both reporting fuel levels.

Can you help?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

View solution in original post

0 Karma

somesoni2
Revered Legend

In final output, do you want to two columns, showing FuelPct for different criteria?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

0 Karma

dhardingatn
New Member

Thank You, I have the Fuel Percentage reporting on a Fuel Gauge to monitor the Fuel. It is working now so that I can combine 2 dashboards into one.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

No problem, glad to help.
FWIW, you can also replace the case function with an if: fuel=if(myFuelLevel > 10000, 0, myFuelLevel) since you only have one condition.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...