Dashboards & Visualizations

How can I group field names to compare values within a specified time range?

Motivator

Hi,

I have around 200 KPIs, each having field names in the form of *KPI and with numbers and each *KPI has different values.
for eg, 100KPI has values 0, 1,56,100 and so on. Is it possible to group all field names in 1 field name as KPI? I need to compare the latest value of each KPI with the 7 day avg datehour count and group it by KPI and display only KPI that have large deviation in single panel.

1 Solution

Esteemed Legend

This is generally done with coalesce like this:

| eval KPI=coalesce(100_KPI, 99_KPI, ..., 1_KPI, "DefaultValueHere")

You can do similar with foreach like this:

| foreach *_KPI [ eval KPI=coalesce(KPI, <<FIELD>>) ]

View solution in original post

Esteemed Legend

This is generally done with coalesce like this:

| eval KPI=coalesce(100_KPI, 99_KPI, ..., 1_KPI, "DefaultValueHere")

You can do similar with foreach like this:

| foreach *_KPI [ eval KPI=coalesce(KPI, <<FIELD>>) ]

View solution in original post

SplunkTrust
SplunkTrust

Hi
You can use foreach command to group 1 field. Can you please share your sample search?

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Foreach

Thanks

0 Karma