Dashboards & Visualizations

Force HTML into results?

andrewkenth
Communicator

Is there a way to force HTML into the results sets? In my case I'd like to insert a line return a results in order to use a single value visualization.

 blah blah blah | eval message=Date + "><![CDATA[<br>]]> " + upper + " GB (of " + Total + " GB)" | table message
Tags (2)
0 Karma
1 Solution

andrewkenth
Communicator

I was able to simply put my message into 1 field using eval and them simply displaying said single field in a single value module:

index=charlesriver sourcetype=disk* sourcetype=diskWatcher_PRD Filesystem=*Raw* OR Filesystem=*apps* | bucket span=1d _time | eval Total=Used+Available | eval Used=(Used/1048576) | eval Total=(Total/1048576) | chart sum(Used) as Used sum(Total) as Total over _time | predict Used as Forecasted lower10=lower upper50=upper future_timespan=550  | eventstats max(upper) AS max latest(Total) as Total latest(Used) as Used | where upper=max | eval Date=strftime(_time,"%m/%d/%Y %A") | eval Current=tostring(round(upper)-round(Used)) |  eval upper=tostring(round(upper)) | eval Total=tostring(round(Total)) | eval message=Date + ": " + Current + " GB (of " + Total + " GB)" | table message

View solution in original post

0 Karma

andrewkenth
Communicator

I was able to simply put my message into 1 field using eval and them simply displaying said single field in a single value module:

index=charlesriver sourcetype=disk* sourcetype=diskWatcher_PRD Filesystem=*Raw* OR Filesystem=*apps* | bucket span=1d _time | eval Total=Used+Available | eval Used=(Used/1048576) | eval Total=(Total/1048576) | chart sum(Used) as Used sum(Total) as Total over _time | predict Used as Forecasted lower10=lower upper50=upper future_timespan=550  | eventstats max(upper) AS max latest(Total) as Total latest(Used) as Used | where upper=max | eval Date=strftime(_time,"%m/%d/%Y %A") | eval Current=tostring(round(upper)-round(Used)) |  eval upper=tostring(round(upper)) | eval Total=tostring(round(Total)) | eval message=Date + ": " + Current + " GB (of " + Total + " GB)" | table message
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you considered using the HTML module instead of SingleValue?

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...