Dashboards & Visualizations

How can I group field names to compare values within a specified time range?

deepashri_123
Motivator

Hi,

I have around 200 KPIs, each having field names in the form of *_KPI and with numbers and each *_KPI has different values.
for eg, 100_KPI has values 0, 1,56,100 and so on. Is it possible to group all field names in 1 field name as KPI? I need to compare the latest value of each KPI with the 7 day avg date_hour count and group it by KPI and display only KPI that have large deviation in single panel.

1 Solution

woodcock
Esteemed Legend

This is generally done with coalesce like this:

| eval KPI=coalesce(100_KPI, 99_KPI, ..., 1_KPI, "DefaultValueHere")

You can do similar with foreach like this:

| foreach *_KPI [ eval KPI=coalesce(KPI, <<FIELD>>) ]

View solution in original post

woodcock
Esteemed Legend

This is generally done with coalesce like this:

| eval KPI=coalesce(100_KPI, 99_KPI, ..., 1_KPI, "DefaultValueHere")

You can do similar with foreach like this:

| foreach *_KPI [ eval KPI=coalesce(KPI, <<FIELD>>) ]

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
You can use foreach command to group 1 field. Can you please share your sample search?

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Foreach

Thanks

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!