Dashboards & Visualizations

Customizing (Rather configuring) dashboard logic

Path Finder


An app that shows how certain function of business is doing during an event. I've Splunk 6.2 dashboard to show about 4~6 panels showing different metrics including what we call as time between states ...

These are calculated as time between different states of an order.


Assume there are five states create, queue , submit, assign, confirm.

One client might require to combine create + queue as one state , while other may require create and queue to be different states of an order..

Meaning, client 1 may consider queue time as assign_timestamp - min(create_timestamp, queue_timestamp) ...client 2 might consider queue time as (quue_timestamp - create_timestamp)


  1. What is the best way to achieve such functionality such that I can configure these calculations as opposed to putting in queries or macros ...for example, can I create an external source of these states and calculations, and refer it in Splunk?

If so How ?

  1. how to achieve the functionality such that when a third client comes with some different need, I can manipulate this external source with sequence of states and/or calculations

Thanks, ronak

0 Karma


I've monkeyed around with having a lookup that maps groups to specific alert to thresholds - something like


What you are proposing potentially could be done in a lookup but my mind slides more toward a complex case statement like

...| eval queue_time = case(group=client1, assign_timestamp - min(create_timestamp, queue_timestamp), group=client2, quue_timestamp - create_timestamp, 1=1, "fix me") | ..

Of course that doesn't really fit what you are looking for; conditions not being in the query or a macro. Of course if you have it in a macro it makes it much easier to update and keep track of /shrug.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...