Dashboards & Visualizations

How can I create a panel that calculates everything and changes the panel color based on the value of Percent Users Online?

albinortiz
Engager

Greetings,

I have a code that calculates a percentage based on the value of two other panels I have. What I want to do is, Instead of having 3 different panels (ie. 1 for Total Registered Users, 1 for Total Online Users, and 1 for the Percent of Users Online), I want to have 1 panel that calculates everything and changes the panel color based on the value of Percent Users Online. The panel needs to display the Total Online Users.

alt text

0 Karma

493669
Super Champion

Try this run anywhere search:

<dashboard>
  <label>singlevalue</label>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal|eval percentage="90"|table percentage </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
       <option name="useColors">1</option>
       </single>
    </panel>
  </row>
</dashboard>

albinortiz
Engager

Alright so I was looking at your code piece and it does what it is intended however, I am running into something I don't quite understand.

Here is the code I am using:

Index=winevents | dedup host
| stats count as TotalActiveHosts
| append [ ldapsearch search = "(objectClass = computer)" attrs = "cn, operatingSysem, operatingSystemVersion"
| lookup dnslookup clienthost AS cn
| search (operatingSystem = "Win*")
| stats count as TotalWinClients
| append [ makeresults
| eval Percent = round ((TotalActiveHosts/TotalWinClients) * 100, 1) ]

So here's my issue: I want to be able to display the TotalActiveHosts and change its color based on the percentage that is being calculated.

Maybe this gives you a clearer picture. All the help I can get is greatly appreciated.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...