Dashboards & Visualizations

How to create a below table?

Path Finder

I Have a table which is a result of below mentioned query. It displays the different parameter values over different servers.

Parameter Server1 Server2 Server3 Server4 Server5 ....

index=auto_prod_cm_comparisions sourcetype=auto_prod_details_log source="/logs/web/output/smartauction2.0/_host_details.log" ":" "architecture" OR "cpu" OR "CPU(s)" NOT crtime NOT cstates_count NOT cstates
NOT snaptime NOT pstates_nsec NOT _ID NOT *_id earliest=-48h |rex field=_raw "(?:[^:\n]:){3}(?.)\s(?.)" |rex field=source "(\d+_){2}(?.\w\d)_" | search Server_Name ="*wb"
|chart limit=0 values(abc) over Parameter1 by Server_Name

How to create a table which adds one more column to above table and display Message as "same" if value of a Parameter is same for each server and display Message as "not same" if for any server we have a different value for that particular parameter.


Parameter Message Server1 Server2 Serevr3 .....

can someone help me update the above query to get the desired result. the view should be same , just need to add one cloumn i.e. "Message" which will display message "same" and "not same" based on comparing a particular parameter values of different servers.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...