Stack Dashboard with 3 values

shahbaz — Thu, 27 Jan 2022 12:05:10 GMT

Hi,

I have a json event like below, for each "Build Version" which runs on weekly/daily basis it will try to install different apps ("appName" in json) reports the app's "Application install status" as "success" or "failure, similarly for "Application launch status" and "apkAnalysed" status as "Analysed" or "Not Analysed"

Now I want a dashboard that looks like below, for each "Build Version" how many have success ,failure status and "apkAnalysed" status as "Analysed" in 3 stacks.

is this possible in splunk, i have tried plotting using chart option but it doesn't help

{ "Device Details": { "Device": "" , "Build Version": "build_01", "Application install status": "success", "Application launch status": "Success" }, "apkAnalysed": "Analysed", "id": "googleplay", "appName": "whatsapp", "appStore": "googleplay", "timeStamp": 0, "md5sum": "", "packageName": "", "date": "2021-12-09", "downloadPath": "https: xxxx", "apkAnalytics": "" }

TIA

Re: Stack Dashboard with 3 values

ITWhisperer — Thu, 27 Jan 2022 12:38:16 GMT

Do you mean something like this?

| makeresults count=10000 | eval _raw="{ \"Device Details\": { \"Device\": \"\" , \"Build Version\": \"build_".printf("%02d",random()%10)."\", \"Application install status\": \"".mvindex(split("success|failure","|"),random()%2)."\", \"Application launch status\": \"".mvindex(split("success|failure","|"),random()%2)."\" }, \"apkAnalysed\": \"".mvindex(split("Not |","|"),random()%2)."Analysed\", \"id\": \"googleplay\", \"appName\": \"whatsapp\", \"appStore\": \"googleplay\", \"timeStamp\": 0, \"md5sum\": \"\", \"packageName\": \"\", \"date\": \"2021-12-09\", \"downloadPath\": \"https: xxxx\", \"apkAnalytics\": \"\" }" | spath "Device Details.Build Version" output=BuildVersion | spath "Device Details.Application install status" output=InstallStatus | spath "Device Details.Application launch status" output=LaunchStatus | spath "apkAnalysed" | stats count(eval(apkAnalysed="Analysed")) as Analysed count(eval(InstallStatus=="success")) as InstallSuccess count(eval(LaunchStatus=="success")) as LaunchSuccess by BuildVersion

topic Re: Stack Dashboard with 3 values in Dashboards & Visualizations

Stack Dashboard with 3 values

Re: Stack Dashboard with 3 values