Dashboards & Visualizations

Need help with creating a dashboard

surekhasplunk
Communicator

Hi,

I want to create a dashboard where i can show like below : Logic is if 1 employee is there in bangalore it should show 1
if 2 employes are there in each Delhi, Mmbai and Bihar it should show 2 against each of the places and should be placed in 2nd row and so on.
Bangalore (1)
Delhi (2) Mumbai (2) Bihar(2)
Jaipur(3) Gurgaon(3)

Additionally i want to color code the cells/boxes as well .

Thanks

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi surekhasplunk,
see this example that should guide you to solve your problem

index=_internal 
| stats dc(date_hour) AS date_hour by sourcetype 
| eval sourcetype=sourcetype+"("+date_hour+")" 
| stats values(sourcetype) AS sourcetype BY date_hour 
| fields - date_hour 
| nomv sourcetype

This is result

   splunk_app_db_connect_dbx.log-too_small(2) splunk_web_access(2) splunk_web_service(2) splunkd_ui_access(2)
    dbx_health_metrics(4) dbx_server(4) mongod(4) scheduler(4) splunkd(4) splunkd_access(4)

If you share your search, I could help you more.

Bye.
Giuseppe

View solution in original post

0 Karma

surekhasplunk
Communicator

alt text

Hi,

This is exactly what i was looking for but additionally i want the count also to be shown in the fist column with the values in the cells as attached in the image.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi surekhasplunk,
see this example that should guide you to solve your problem

index=_internal 
| stats dc(date_hour) AS date_hour by sourcetype 
| eval sourcetype=sourcetype+"("+date_hour+")" 
| stats values(sourcetype) AS sourcetype BY date_hour 
| fields - date_hour 
| nomv sourcetype

This is result

   splunk_app_db_connect_dbx.log-too_small(2) splunk_web_access(2) splunk_web_service(2) splunkd_ui_access(2)
    dbx_health_metrics(4) dbx_server(4) mongod(4) scheduler(4) splunkd(4) splunkd_access(4)

If you share your search, I could help you more.

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi surekhasplunk,
try

index=_internal 
 | stats dc(date_hour) AS date_hour by sourcetype 
 | eval sourcetype=sourcetype+"("+date_hour+")" 
 | stats dc(sourcetype) AS quantity values(sourcetype) AS sourcetype BY date_hour 
 | fields - date_hour 
 | nomv sourcetype

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...