topic Re: Dashboard SPL in Dashboards & Visualizations

Dashboard SPL

phanikumarcs — Wed, 14 Feb 2024 17:03:37 GMT

HIi @ITWhisperer
index=foo sourcetype=json_foo source="az-foo"
|rename tags.envi as env
|search env="*A00001*" OR env="*A00002*" OR env="*A00005*" OR env="*A00020*"
|table env

from the fields i am using:
env="*A00001*" as "PBC"
env="*A00002*" as "PBC"
env="*A00005*" as "KCG
env="*A00020*" as "TTK"

reference:

From this SPL, i am trying to create a table like
------------------------------------------------------
PBC | KCG | TTK
-------------------------------------------------------
all values all values all values
count count count

Re: Dashboard SPL

ITWhisperer — Wed, 14 Feb 2024 17:34:56 GMT

Do you mean something like this

index=foo sourcetype=json_foo source="az-foo" |rename tags.envi as env |search env="*A00001*" OR env="*A00002*" OR env="*A00005*" OR env="*A00020*" |stats count by env

Re: Dashboard SPL

phanikumarcs — Wed, 14 Feb 2024 21:16:02 GMT

@ITWhisperer No, i mean like, i tried already as you suggested.

From below said, under field PBC the field values comes under A00001, A00002 so for same other KCG and TTK as well, so these can show up in the table like above.

env="*A00001*" as "PBC"

env="*A00002*" as "PBC"

env="*A00005*" as "KCG

env="*A00020*" as "TTK"

Re: Dashboard SPL

ITWhisperer — Thu, 15 Feb 2024 09:54:12 GMT

index=foo sourcetype=json_foo source="az-foo" |rename tags.envi as env |search env="*A00001*" OR env="*A00002*" OR env="*A00005*" OR env="*A00020*" |stats count by env |eval env=case(match(env,"A00001"),"PBC",match(env,"A00002"),"PBC",match(env,"A00005"),"KCG",match(env,"A00020"),"TTK",true(),env)

Re: Dashboard SPL

phanikumarcs — Thu, 15 Feb 2024 11:43:09 GMT

@ITWhisperer thanks for the solution, i did little changes as per my desired results.