Dashboards & Visualizations

Horseshoe visualisation - Complex Logic

RobertEttinger8
Explorer

Hi,

I've been struggling with the horseshoe visualisation for a couple days. I have a specific scenario I would like to present but not sure if this can be done:

I have a table with 2 rows and 3 fields per row: source, count, status. Example:

source,count,status

sourceA,200,0(not breached)

sourceB,100,0(not breached)

sourceC, 100,1(breached)

I would like to show a horseshoe per source (trellis) where the dial shows the count but the color is based on the status. So, for instance, sources B and C would be similar looking (count-wise) but the color would be different as one is breached and the other one is not...

Is that possible? I've seen some posts about showing a different value as a token, but this doesn't work because 1-I need to work with multiple sources and 2-Each row may have its own threshold....

Thanks! 🙂

Labels (3)
Tags (3)
0 Karma

tscroggins
Champion

@RobertEttinger8 

Are you using the built-in radial gauge or the custom horseshoe meter?

The horseshoe meter trellis option splits by aggregation (column), so your results should include one event with one field per value:

| makeresults count=3
| streamstats count
| eval value=round(100*random()/2147483647)
| fields - _time
| transpose 0 header_field=count
| fields - column

RobertEttinger8_horseshoe.png

0 Karma

RobertEttinger8
Explorer

Hi,

 

I was talking about the horseshoe meter... 

 

The challenge comes when trying to apply different thresholds per horseshoe when using trellis and to display a value but the color of the threshold is based on another field... I actually found a visualization that allows this, the "Display Number Viz". It is a game changer for me 🙂

Thanks,

R

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...