Splunk Search

How to use stats or chart by multiple columns while using visualizations?

AK89
Explorer

Here is the sample data set:

ENTITY_NAME REPLICATION_OF VALUE
server1 BackupA 59
server2 BackupB 28
server3 backup_noenc_h1 54
server3 backup_utility_h1 96
server4 backup_noenc_h2 40
server4 backup_utility_h2 700

 

I want to be able to use the number display visualization to display entity_name, replication_of, and latest value for each record. I've tried these:

| stats latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) over REPLICATION_OF by ENTITY_NAME

Ultimately I want something that looks like this, but not sure if you can display three data series in a number display. If this isn't possible, what would be the best way to visualize a data set like this?

AK89_0-1659056729061.png

 

 

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

AK89
Explorer

This worked great for my number display, but I can't seem to get it to work on the radial gauges like your screenshot. Did you have to do something else to get it to populate multiple gauges? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm not aware of any special setting.  I'm using a 9.0.0 installation.  After the stats, Splunk visualization automatically selected "Radial Gauge".  All I did is select trellis.

Screen Shot 2022-07-29 at 9.17.27 PM.png

By default, radial gauge uses the "shiny" skin; another skin (style) is "minimal", like this

Screen Shot 2022-07-29 at 9.15.35 PM.png

0 Karma

AK89
Explorer

I thought of trying something like that last night (combining the values into one field) but couldn't get it to work. Thanks a lot, this accomplishes what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...