Dashboards & Visualizations

How do you display code type and severity level in a single value cell?

noviceinsplunk
New Member

I need to display 2 different value in a single value cell.

Here is a sample of the current dashboard, split by code A,C,T,and S and minimum delay in minutes, which zero minute delay in delivery of these code types.

| A | C |T | S|
| 0 |0 | 0 | 0|

Want to display the severity level of the code (where there is only 2 levels...HC=high critical or CR=critical-, such as below.

The severity code for each code is a constant and doesn’t change .

The update dashboard would be:
| A ,HC|C,HC|T,HC| S,CR|
| 0 |0 | 0 | 0|

0 Karma
1 Solution

renjith_nair
Legend

@noviceinsplunk ,

You can concatenate the fields to get the values appended.

For eg. eval A=A."HC",C=C."HC" etc.

And you can change the field names using rename

For e.g.if your severity level for HC=2 and CR=1 then,

your current search |eval A=A.",2",C=C.",2",T=T.",2",S=S.",1"
|rename A as "A,HC",C  as "C,HC",T as "T,HC",S as "S,CR"
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

0 Karma

renjith_nair
Legend

@noviceinsplunk ,

You can concatenate the fields to get the values appended.

For eg. eval A=A."HC",C=C."HC" etc.

And you can change the field names using rename

For e.g.if your severity level for HC=2 and CR=1 then,

your current search |eval A=A.",2",C=C.",2",T=T.",2",S=S.",1"
|rename A as "A,HC",C  as "C,HC",T as "T,HC",S as "S,CR"
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

msmullinax
New Member

That worked. Thanks.

0 Karma

renjith_nair
Legend

Glad to know. Kindly accept as answer if you dont have further questions on this @noviceinsplunk

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...