Dashboards & Visualizations

How can I group field names to compare values within a specified time range?

deepashri_123
Motivator

Hi,

I have around 200 KPIs, each having field names in the form of *_KPI and with numbers and each *_KPI has different values.
for eg, 100_KPI has values 0, 1,56,100 and so on. Is it possible to group all field names in 1 field name as KPI? I need to compare the latest value of each KPI with the 7 day avg date_hour count and group it by KPI and display only KPI that have large deviation in single panel.

1 Solution

woodcock
Esteemed Legend

This is generally done with coalesce like this:

| eval KPI=coalesce(100_KPI, 99_KPI, ..., 1_KPI, "DefaultValueHere")

You can do similar with foreach like this:

| foreach *_KPI [ eval KPI=coalesce(KPI, <<FIELD>>) ]

View solution in original post

woodcock
Esteemed Legend

This is generally done with coalesce like this:

| eval KPI=coalesce(100_KPI, 99_KPI, ..., 1_KPI, "DefaultValueHere")

You can do similar with foreach like this:

| foreach *_KPI [ eval KPI=coalesce(KPI, <<FIELD>>) ]

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
You can use foreach command to group 1 field. Can you please share your sample search?

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Foreach

Thanks

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...