topic Re: Single Value Visualization in Splunk Search

Single Value Visualization

AC1 — Fri, 05 Jan 2024 16:23:45 GMT

Hi all,

I am trying to use the Single Value Visualization in a dashboard to keep an all time running count of my field "id".

The issue I'm running into is I have duplicate logs for "id" that are giving me an incorrect number. When I am running a search with the SPL below and dedup I get the correct number of events. But when I try to convert that into the Visualization I am having issues. Any help is appreciated, thanks!

Index="xx" label="xx" id=* | dedup id

Re: Single Value Visualization

PickleRick — Fri, 05 Jan 2024 17:12:20 GMT

Visualization only shows the value you give it so you need to search for the proper value.

As you have multiple values of the id field, it's no wonder that you'll get bad results if you expect just one value. So it's up to you to redefine the problem. If you want to somehow decide to return just one of those ids, you have to make that choice.

BTW "dedup id" will still return multiple values if you have multiple ids. So please define your desired result more precisely.

Re: Single Value Visualization

gcusello — Fri, 05 Jan 2024 17:26:57 GMT

Hi @AC1 ,

try something like this:

Index="xx" label="xx" id=* | stats dc(id) AS id_count

Ciao.

Giuseppe