Dashboards & Visualizations

How do you display code type and severity level in a single value cell?

New Member

I need to display 2 different value in a single value cell.

Here is a sample of the current dashboard, split by code A,C,T,and S and minimum delay in minutes, which zero minute delay in delivery of these code types.

| A | C |T | S|
| 0 |0 | 0 | 0|

Want to display the severity level of the code (where there is only 2 levels...HC=high critical or CR=critical-, such as below.

The severity code for each code is a constant and doesn’t change .

The update dashboard would be:
| A ,HC|C,HC|T,HC| S,CR|
| 0 |0 | 0 | 0|

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@noviceinsplunk ,

You can concatenate the fields to get the values appended.

For eg. eval A=A."HC",C=C."HC" etc.

And you can change the field names using rename

For e.g.if your severity level for HC=2 and CR=1 then,

your current search |eval A=A.",2",C=C.",2",T=T.",2",S=S.",1"
|rename A as "A,HC",C  as "C,HC",T as "T,HC",S as "S,CR"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@noviceinsplunk ,

You can concatenate the fields to get the values appended.

For eg. eval A=A."HC",C=C."HC" etc.

And you can change the field names using rename

For e.g.if your severity level for HC=2 and CR=1 then,

your current search |eval A=A.",2",C=C.",2",T=T.",2",S=S.",1"
|rename A as "A,HC",C  as "C,HC",T as "T,HC",S as "S,CR"

View solution in original post

0 Karma

New Member

That worked. Thanks.

0 Karma

SplunkTrust
SplunkTrust

Glad to know. Kindly accept as answer if you dont have further questions on this @noviceinsplunk

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!