Splunk Search

horse shoe meter for visualisation

Deepz2612
Explorer

Hi I have a query to see the success and failure rate.
The query will give the fields success and failure rate as output.
I wanted to use horse shoe meter visualization but the meter shows both the rates but the numeric value being displayed is either success rate or the failure rate but not both.
Could you please help.

Tags (1)
0 Karma

niketn
Legend

@Deepz2612 try the following run anywhere example. It does the following:

1) Runs an independent search (search without visualization), to get the Success and Failure rate.
2) Using Search Event Handler sets the tokens for Success Rate and Failure Rate.
3) Inside the Horseshoe custom visualization, use run anywhere search and display one of success or failure token based on which Radial Chart needs to be drawn using corresponding token set in the previous step.
4) Use the tokens to display the Caption text as expected.
5) Give an id to the horseshoe meter and use CSS Selector to
a) Hide actual horseshoe meter text using CSS selector.
b) Change the font and position of the caption position to override the actual value position and font.

alt text

Following is the complete code for the run anywhere example as per your use case:

<dashboard>
  <label>Horseshoe Meter</label>
  <search>
    <query>| makeresults
| fields - _time
| eval success=random()
| eval success=substr(success,0,2)
| eval failure=100-success
    </query>
    <progress>
      <set token="tokSuccess">$result.success$</set>
      <set token="tokFailure">$result.failure$</set>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <style>
          #my_horseshoe_meter .meter-center-text{
            visibility: hidden !important;
          }
          #my_horseshoe_meter .meter-under-text{
            font-size: 50px !important;
            font-weight: 250 !important;
            transform: translateY(15px) !important;
          }
        </style>
      </html>
      <viz id="my_horseshoe_meter" type="horseshoe_meter_app.horseshoe_meter">
        <search>
          <query>| makeresults
          | fields - _time
          | eval failure="$tokFailure$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="horseshoe_meter_app.horseshoe_meter.backgroundColor">#ccc</option>
        <option name="horseshoe_meter_app.horseshoe_meter.caption">$tokFailure$/$tokSuccess$</option>
        <option name="horseshoe_meter_app.horseshoe_meter.dialColor">#fff</option>
        <option name="horseshoe_meter_app.horseshoe_meter.maxRangeColor">#b44441</option>
        <option name="horseshoe_meter_app.horseshoe_meter.maxRangeThreshold">30</option>
        <option name="horseshoe_meter_app.horseshoe_meter.maxValue">100</option>
        <option name="horseshoe_meter_app.horseshoe_meter.midRangeColor">#fbcd2f</option>
        <option name="horseshoe_meter_app.horseshoe_meter.midRangeThreshold">10</option>
        <option name="horseshoe_meter_app.horseshoe_meter.minRangeColor">#3fc77a</option>
        <option name="horseshoe_meter_app.horseshoe_meter.minValue">0</option>
        <option name="horseshoe_meter_app.horseshoe_meter.thresholdStyle">realValue</option>
        <option name="horseshoe_meter_app.horseshoe_meter.useRangemap">true</option>
        <option name="horseshoe_meter_app.horseshoe_meter.valueColor">#555</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Deepz2612
Explorer

Hi,
I tried the above and receiving the error as below.
Error rendering Horseshoe Meter visualization: This visualization cannot render non-numeric results. To build a horseshoe meter visualization, use a search that returns numeric values.

0 Karma

niketn
Legend

@Deepz2612 Did you get issue with run anywhere example or your own implementation?
Did you print the value of $tokFailure$ which is used in Horseshoe Meter? Is it numeric?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...