Dynamic gauge values

[Marco]

Hi Splunkers,

I am currently trying to create a gauge visualization, but the issue is that my daily number of events is showing up as 0.

This is my query:

host=* COMMAND="PWD"| bucket _time span=day
| stats count by _time| outlier | stats max(count) as mx | eval y1=mx/4| eval y2= y1*2 | eval y3= y1*3| eval y4= mx | gauge count 0 y1 y2 y3 y4

As you can see the gauge is pegged at zero. The needle represents the total number of events for today.

Any suggestions?

Thank You, 

Marco

[richgalloway]

The problem is there is no field called "count" for the gauge command to display.  Try 

... | | gauge mx 0 y1 y2 y3 y4

BTW, I don't see the point of having the gauge always pinned at the max value.