Dashboards & Visualizations

Building a table with multiple predict values

aohls
Contributor

I have see a few older questions on something like this but nothing too new. I have a table right now we manually generate using a number of searches; getting data for the past few weeks. Using this as a way to identify trends and find items with low volume or long response times. Using predict would greatly reduce this need but, I would need a split by clause.

In Short I am getting something like

_timeVolumelow(predicted(Volume)high(predicted(Volume)ResponseTimelow(predicted(ResponseTime)high(predicted(ResponseTime)

 

What I would like is.

OperationVolumelow(predicted(Volume)high(predicted(Volume)ResponseTimelow(predicted(ResponseTime)high(predicted(ResponseTime)
op1104159515
op25295110

 

I am tabling the data so I would only have one entry for each operation.  I want it to show an overview of the operations using the predicted values for context and then I would create formatting if they are outside some bounds of the predicted value.

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...