Dashboards & Visualizations

Average output of 3 panels in one panel

kumargaurav11
Loves-to-Learn

I have 3 panels with single values in a dashboard.
 Example :
Panel A : 15HRS
Panel B : 3 HRS
Panel C : 4 HRS

I want average of all 3 in one panel say Panel D= avg(Panel A,B,C).
Since searches in panel A,B & C are different and having different sourcetype/indexes so don't want to merge all the searches in one.


Labels (3)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

@kumargaurav11 ...as your query is resolved, please accept @to4kawa 's answer as solution. thanks and karma points appreciated!

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

to4kawa
Ultra Champion
<dashboard>
  <label>sample1</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval result="1"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="search1">$result.result$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval result="2"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="search2">$result.result$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval result="3"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="search3">$result.result$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval average=round(($search1$+$search2$+$search3$)/3,1)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>

to4kawa
Ultra Champion
0 Karma

kumargaurav11
Loves-to-Learn

@to4kawa - Could you please help with a sample query or some specific examples.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...