Dashboards & Visualizations

How do you display code type and severity level in a single value cell?

New Member

I need to display 2 different value in a single value cell.

Here is a sample of the current dashboard, split by code A,C,T,and S and minimum delay in minutes, which zero minute delay in delivery of these code types.

| A | C |T | S|
| 0 |0 | 0 | 0|

Want to display the severity level of the code (where there is only 2 levels...HC=high critical or CR=critical-, such as below.

The severity code for each code is a constant and doesn’t change .

The update dashboard would be:
| A ,HC|C,HC|T,HC| S,CR|
| 0 |0 | 0 | 0|

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@noviceinsplunk ,

You can concatenate the fields to get the values appended.

For eg. eval A=A."HC",C=C."HC" etc.

And you can change the field names using rename

For e.g.if your severity level for HC=2 and CR=1 then,

your current search |eval A=A.",2",C=C.",2",T=T.",2",S=S.",1"
|rename A as "A,HC",C  as "C,HC",T as "T,HC",S as "S,CR"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@noviceinsplunk ,

You can concatenate the fields to get the values appended.

For eg. eval A=A."HC",C=C."HC" etc.

And you can change the field names using rename

For e.g.if your severity level for HC=2 and CR=1 then,

your current search |eval A=A.",2",C=C.",2",T=T.",2",S=S.",1"
|rename A as "A,HC",C  as "C,HC",T as "T,HC",S as "S,CR"

View solution in original post

0 Karma

New Member

That worked. Thanks.

0 Karma

SplunkTrust
SplunkTrust

Glad to know. Kindly accept as answer if you dont have further questions on this @noviceinsplunk

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!