Dashboards & Visualizations

How do I use a different aggregator based on a token?

sillingworth
Path Finder

I have this search:

... 
| rename value as "Response Time"
| timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false

and I'd like to allow 'max("Response Time")' to change to 'avg("Response Time")' depending on user input. Is there a way to do this?

I've tried $token$("Response Time") but that doesn't work.

Tags (2)
0 Karma
1 Solution

sillingworth
Path Finder

Here's how I've done it:

        ...
        | stats max(value) as PerMinMax, avg(value) as PerMinAvg by _time, app_name
        | eval "Response Time"=case("Average"=="Max", PerMinMax, "Average"=="Average", PerMinAvg) 
        | timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false

View solution in original post

0 Karma

sillingworth
Path Finder

Here's how I've done it:

        ...
        | stats max(value) as PerMinMax, avg(value) as PerMinAvg by _time, app_name
        | eval "Response Time"=case("Average"=="Max", PerMinMax, "Average"=="Average", PerMinAvg) 
        | timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...