topic How to Display query result in text format,rather that a graph(chart or timechart)?) in Splunk Search

How to Display query result in text format,rather that a graph(chart or timechart)?)

geetanjali — Mon, 28 Sep 2020 09:38:20 GMT

Hello,

Thanks in advance.

I have one pie chart graph in a view having sum of power usage as per host.I want to display total power usage just below the pie chart. I want to display in text format. As of now, i am displaying in table format with following query :

index="test" sourcetype="test_usage" | chart sum(Power_consumption) as Total(W)

How could i display the result of this query in text format?

Geetanjali

Re: How to Display query result in text format,rather that a graph(chart or timechart)?)

mw — Thu, 02 Jun 2011 12:47:00 GMT

How about using a Single Value element? You could, for extra credit :), also sprinkle in the rangemap command to have the Single Value show a green/yellow/red state based on the total consumption, if desired:

index="test" sourcetype="test_usage" | stats sum(Power_consumption) as total_pc | rangemap field=total_pc low=0-20 elevated=21-100 default=severe

Outside of that, I think you'd be hacking advanced xml to put a straight text value in there (but I'm not completely confident of that either).