Hi,
I want to create a dashboard where i can show like below : Logic is if 1 employee is there in bangalore it should show 1
if 2 employes are there in each Delhi, Mmbai and Bihar it should show 2 against each of the places and should be placed in 2nd row and so on.
Bangalore (1)
Delhi (2) Mumbai (2) Bihar(2)
Jaipur(3) Gurgaon(3)
Additionally i want to color code the cells/boxes as well .
Thanks
Hi surekhasplunk,
see this example that should guide you to solve your problem
index=_internal
| stats dc(date_hour) AS date_hour by sourcetype
| eval sourcetype=sourcetype+"("+date_hour+")"
| stats values(sourcetype) AS sourcetype BY date_hour
| fields - date_hour
| nomv sourcetype
This is result
splunk_app_db_connect_dbx.log-too_small(2) splunk_web_access(2) splunk_web_service(2) splunkd_ui_access(2)
dbx_health_metrics(4) dbx_server(4) mongod(4) scheduler(4) splunkd(4) splunkd_access(4)
If you share your search, I could help you more.
Bye.
Giuseppe
Hi surekhasplunk,
see this example that should guide you to solve your problem
index=_internal
| stats dc(date_hour) AS date_hour by sourcetype
| eval sourcetype=sourcetype+"("+date_hour+")"
| stats values(sourcetype) AS sourcetype BY date_hour
| fields - date_hour
| nomv sourcetype
This is result
splunk_app_db_connect_dbx.log-too_small(2) splunk_web_access(2) splunk_web_service(2) splunkd_ui_access(2)
dbx_health_metrics(4) dbx_server(4) mongod(4) scheduler(4) splunkd(4) splunkd_access(4)
If you share your search, I could help you more.
Bye.
Giuseppe
Hi surekhasplunk,
try
index=_internal
| stats dc(date_hour) AS date_hour by sourcetype
| eval sourcetype=sourcetype+"("+date_hour+")"
| stats dc(sourcetype) AS quantity values(sourcetype) AS sourcetype BY date_hour
| fields - date_hour
| nomv sourcetype
Bye.
Giuseppe