Dashboards & Visualizations

How to map a search in Splunk Dashboard Studio?

ichesla1111
Path Finder

Hello! I am trying to map a search in Splunk Studio Dashboards to create a time chart showing a machines utilization per day. I want to show it by day so I can add a trend line to my single value utilization panel.

To do this, I am mapping my search by day so, the utilization will be calculated per day rather than over the whole-time range.

Using the code below I am able to make a time chart displaying the machines daily utilization in dashboard classic but not dashboard studios:

Code:

index=example |bin span=1d _time |dedup _time
| eval start=relative_time(_time,"@d-1d"), end=relative_time(_time,"@d")
|eval day=strftime(_time,"%D %T")
|eval End=strftime(end,"%D %T")

|map maxsearches=30 search="search index=example earliest=\"$$start$$\" latest=$$end$$
| transaction Machine maxpause=300s maxspan=1d keepevicted=T keeporphans=T
| addinfo|bin span=1d _time
| eval timepast=info_max_time-info_min_time
| eventstats sum(duration) as totsum by Machine _time  |dedup Machine _time
| eval Util=min(round( (totsum)/(timepast) *100,1),100)
| stats values(Util) as \"Utilization\" by Machine _time date_mday"
|table _time Utilization Machine

|chart values(Utilization) by _time Machine
|fillnull value="0"

Code Results in Dashboard Classic:

ichesla1111_0-1675096776335.png



Code result in Dashboard Studio:

ichesla1111_1-1675096915365.png

 



Why can't I map on Dashboard Studio?? It states it is waiting for an input. How can I break up utilization by day to show the trend line?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...