Dashboards & Visualizations

How to create a dashboard with a Single Value visualization for each hostname?

jeffbat
Path Finder

I have a pivot table that has countervalues with a time value and hostname. I am trying to make a dashboard that will show the values using Single Value but one single value for each hostname.

This is the search:

| pivot Capacity_Planning_Pivot__Test CapcityCounters count(CapcityCounters) AS "count(CapcityCounters)" SPLITROW _time AS _time PERIOD day SPLITROW Path AS Path SPLITROW AverageValue AS AverageValue FILTER Path contains WEBSVC SORT 5000 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 | fields - "count(CapcityCounters)" | timechart span=7d avg(AverageValue) by Path

(path is the hostname and it goes back for 1 month broken up into 7 day increments so that I can get a trendline)

Doing this directly will show a table with time on the left for rows and hostname on top for columns. But if I change it to a visualization of Single Value, I only get the first hostname column value and the trend is just based off that one. Which would be fine if I could get a single value box for each of the different columns.

Is there anyway to do this?

Thanks.

lguinn2
Legend

There is no way to do this directly. But you could use your search as a base search, and then have a post-process search for each Single Value panel that simply selects one of the result columns from the base search. It isn't going to be very dynamic though: you will have to pre-determine the various hosts.

Here is a link to the documentation for base searches and post-process searches.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...