I have a pivot table that has countervalues with a time value and hostname. I am trying to make a dashboard that will show the values using Single Value but one single value for each hostname.
This is the search:
| pivot Capacity_Planning_Pivot__Test CapcityCounters count(CapcityCounters) AS "count(CapcityCounters)" SPLITROW _time AS _time PERIOD day SPLITROW Path AS Path SPLITROW AverageValue AS AverageValue FILTER Path contains WEBSVC SORT 5000 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 | fields - "count(CapcityCounters)" | timechart span=7d avg(AverageValue) by Path
(path is the hostname and it goes back for 1 month broken up into 7 day increments so that I can get a trendline)
Doing this directly will show a table with time on the left for rows and hostname on top for columns. But if I change it to a visualization of Single Value, I only get the first hostname column value and the trend is just based off that one. Which would be fine if I could get a single value box for each of the different columns.
Is there anyway to do this?
Thanks.
There is no way to do this directly. But you could use your search as a base search, and then have a post-process search for each Single Value panel that simply selects one of the result columns from the base search. It isn't going to be very dynamic though: you will have to pre-determine the various hosts.
Here is a link to the documentation for base searches and post-process searches.