Need help with creating a dashboard

[surekhasplunk]

Hi,

I want to create a dashboard where i can show like below : Logic is if 1 employee is there in bangalore it should show 1
if 2 employes are there in each Delhi, Mmbai and Bihar it should show 2 against each of the places and should be placed in 2nd row and so on.
Bangalore (1)
Delhi (2) Mumbai (2) Bihar(2)
Jaipur(3) Gurgaon(3)

Additionally i want to color code the cells/boxes as well .

Thanks

[surekhasplunk]

Hi,

This is exactly what i was looking for but additionally i want the count also to be shown in the fist column with the values in the cells as attached in the image.

Thanks

[gcusello · Accepted solution]

Hi surekhasplunk,
see this example that should guide you to solve your problem

index=_internal 
| stats dc(date_hour) AS date_hour by sourcetype 
| eval sourcetype=sourcetype+"("+date_hour+")" 
| stats values(sourcetype) AS sourcetype BY date_hour 
| fields - date_hour 
| nomv sourcetype

This is result

   splunk_app_db_connect_dbx.log-too_small(2) splunk_web_access(2) splunk_web_service(2) splunkd_ui_access(2)
    dbx_health_metrics(4) dbx_server(4) mongod(4) scheduler(4) splunkd(4) splunkd_access(4)

If you share your search, I could help you more.

Bye.
Giuseppe

[gcusello]

Hi surekhasplunk,
try

index=_internal 
 | stats dc(date_hour) AS date_hour by sourcetype 
 | eval sourcetype=sourcetype+"("+date_hour+")" 
 | stats dc(sourcetype) AS quantity values(sourcetype) AS sourcetype BY date_hour 
 | fields - date_hour 
 | nomv sourcetype

Bye.
Giuseppe