I have a pivot table that has countervalues with a time value and hostname. I am trying to make a dashboard that will show the values using Single Value but one single value for each hostname.
This is the search:
| pivot Capacity_Planning_Pivot__Test CapcityCounters count(CapcityCounters) AS "count(CapcityCounters)" SPLITROW _time AS _time PERIOD day SPLITROW Path AS Path SPLITROW AverageValue AS AverageValue FILTER Path contains WEBSVC SORT 5000 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 | fields - "count(CapcityCounters)" | timechart span=7d avg(AverageValue) by Path
(path is the hostname and it goes back for 1 month broken up into 7 day increments so that I can get a trendline)
Doing this directly will show a table with time on the left for rows and hostname on top for columns. But if I change it to a visualization of Single Value, I only get the first hostname column value and the trend is just based off that one. Which would be fine if I could get a single value box for each of the different columns.
There is no way to do this directly. But you could use your search as a base search, and then have a post-process search for each Single Value panel that simply selects one of the result columns from the base search. It isn't going to be very dynamic though: you will have to pre-determine the various hosts.
Here is a link to the documentation for base searches and post-process searches.