Dashboards & Visualizations

How to map a search in Splunk Dashboard Studio?

ichesla1111
Path Finder

Hello! I am trying to map a search in Splunk Studio Dashboards to create a time chart showing a machines utilization per day. I want to show it by day so I can add a trend line to my single value utilization panel.

To do this, I am mapping my search by day so, the utilization will be calculated per day rather than over the whole-time range.

Using the code below I am able to make a time chart displaying the machines daily utilization in dashboard classic but not dashboard studios:

Code:

index=example |bin span=1d _time |dedup _time
| eval start=relative_time(_time,"@d-1d"), end=relative_time(_time,"@d")
|eval day=strftime(_time,"%D %T")
|eval End=strftime(end,"%D %T")

|map maxsearches=30 search="search index=example earliest=\"$$start$$\" latest=$$end$$
| transaction Machine maxpause=300s maxspan=1d keepevicted=T keeporphans=T
| addinfo|bin span=1d _time
| eval timepast=info_max_time-info_min_time
| eventstats sum(duration) as totsum by Machine _time  |dedup Machine _time
| eval Util=min(round( (totsum)/(timepast) *100,1),100)
| stats values(Util) as \"Utilization\" by Machine _time date_mday"
|table _time Utilization Machine

|chart values(Utilization) by _time Machine
|fillnull value="0"

Code Results in Dashboard Classic:

ichesla1111_0-1675096776335.png



Code result in Dashboard Studio:

ichesla1111_1-1675096915365.png

 



Why can't I map on Dashboard Studio?? It states it is waiting for an input. How can I break up utilization by day to show the trend line?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...