Dashboards & Visualizations

How to display average from referenced dashboard widget results?

ChadW
Explorer

I have a dashboard that displays 3 radials. I want to display the average of the numeric result of those three radials also on the dashboard. I can create references to those radials and refer to their results something like ($ds_1:result.avg$ + $ds_3:result.avg$ + $ds_3:result.avg$) / 3 but I don't know how to create SPL to do just that vs looking up logs. For example, I tried 

 

 

| eval avg=($ds_1:result.avg$ + $ds_3:result.avg$ + $ds_3:result.avg$) / 3 | table avg

 

 

this didn't work. For context, each of those referred datasources outputs avg(field) as avg. 

How can I achieve what I'm after?

Labels (2)
0 Karma
1 Solution

ChadW
Explorer

I figured this out using makeresults:

| makeresults format=csv data="val
$ds_1:result.avg$
$ds_3:result.avg$
$ds_3:result.avg$" | stats avg(val)

View solution in original post

0 Karma

ChadW
Explorer

I figured this out using makeresults:

| makeresults format=csv data="val
$ds_1:result.avg$
$ds_3:result.avg$
$ds_3:result.avg$" | stats avg(val)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In SimpleXML dashboards, you can declare a done handler - in the done handler for each radial search, you can declare a token for the result you want. You can then use these tokens elsewhere in the dashboard.

0 Karma

ChadW
Explorer

I'm using Dashboard Studio. I can reference the final result (like I mentioned in my original post) but that is intended to feed into a search. I just want to use that final result as part of a mathematical equation -- averaging multiple final results together. Is that possible?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...