topic Re: Unable to visualize the dashboard as per the requirement in Dashboards & Visualizations

Unable to visualize the dashboard as per the requirement

shenoyveer — Tue, 07 Jan 2025 15:12:10 GMT

Hi Everyone,

I am trying to create one dashboard out of search query but I am getting stuck where I am unable to the host details in the dashboard.

query is -

index="vm-details" | eval date=strftime(_time, "%Y-%m-%d") | stats dc(host) as host_count, values(host) as hosts by date | sort date

I am getting host_count and date in dashboard but my requirement is I need hostname should come while hovering host_count

I tried using values(host) directly but that didnt work.

can someone help?

CC: @ITWhisperer

Thanks,
Veeresh Shenoy S

Re: Unable to visualize the dashboard as per the requirement

kiran_panchavat — Tue, 07 Jan 2025 12:17:16 GMT

@shenoyveer Try this and see if it meets your requirements. You can remove | eval date=strftime(_time, "%Y-%m-%d")

Re: Unable to visualize the dashboard as per the requirement

shenoyveer — Tue, 07 Jan 2025 16:58:57 GMT

Hi Kiran,

Thanks for the prompt reply. Its not working for me and after removing eval no data popping up.

my goad is to get the hostname while hovering the host_count variable from query

Re: Unable to visualize the dashboard as per the requirement

shenoyveer — Tue, 07 Jan 2025 17:08:40 GMT

Tried with another query too

index="testing" | eval date=strftime(_time, "%Y-%m-%d") | stats count by date, host

but still its not showing hostname in dashboard

Re: Unable to visualize the dashboard as per the requirement

kiran_panchavat — Tue, 07 Jan 2025 17:12:55 GMT

@shenoyveer

If you take out the eval from the query, you must also remove the date field from it.

index="vm-details"
| timechart count by host

Re: Unable to visualize the dashboard as per the requirement

shenoyveer — Tue, 07 Jan 2025 17:15:09 GMT

is there any alternative to timechart?

I want to have particular date in x axis

Re: Unable to visualize the dashboard as per the requirement

kiran_panchavat — Tue, 07 Jan 2025 17:42:13 GMT

@shenoyveer

Can you check this?

The x-axis will be the first column/field in the results, so put the date as the first field after the by.

Re: Unable to visualize the dashboard as per the requirement

kiran_panchavat — Tue, 07 Jan 2025 17:47:37 GMT

@shenoyveer You can use trellis, split by host.

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Re: Unable to visualize the dashboard as per the requirement

isoutamo — Wed, 08 Jan 2025 18:28:49 GMT

Please write all SPL etc. inside </> tags. That way those are easier to take into use. It also ensure that we can get the same SPL what you have write into your example.

Re: Unable to visualize the dashboard as per the requirement

shenoyveer — Thu, 09 Jan 2025 04:57:58 GMT

Thanks Kiran 🙂