Hi Splunkers,
I am currently trying to create a gauge visualization, but the issue is that my daily number of events is showing up as 0.
This is my query:
host=* COMMAND="PWD"| bucket _time span=day
| stats count by _time| outlier | stats max(count) as mx | eval y1=mx/4| eval y2= y1*2 | eval y3= y1*3| eval y4= mx | gauge count 0 y1 y2 y3 y4
As you can see the gauge is pegged at zero. The needle represents the total number of events for today.
Any suggestions?
Thank You,
Marco
The problem is there is no field called "count" for the gauge command to display. Try
... | | gauge mx 0 y1 y2 y3 y4
BTW, I don't see the point of having the gauge always pinned at the max value.