Dashboards & Visualizations

How do I use a different aggregator based on a token?

sillingworth
Path Finder

I have this search:

... 
| rename value as "Response Time"
| timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false

and I'd like to allow 'max("Response Time")' to change to 'avg("Response Time")' depending on user input. Is there a way to do this?

I've tried $token$("Response Time") but that doesn't work.

Tags (2)
0 Karma
1 Solution

sillingworth
Path Finder

Here's how I've done it:

        ...
        | stats max(value) as PerMinMax, avg(value) as PerMinAvg by _time, app_name
        | eval "Response Time"=case("Average"=="Max", PerMinMax, "Average"=="Average", PerMinAvg) 
        | timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false

View solution in original post

0 Karma

sillingworth
Path Finder

Here's how I've done it:

        ...
        | stats max(value) as PerMinMax, avg(value) as PerMinAvg by _time, app_name
        | eval "Response Time"=case("Average"=="Max", PerMinMax, "Average"=="Average", PerMinAvg) 
        | timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...