Dashboards & Visualizations

Ordering Chart's Bars

jsven7
Communicator

I'm charting disk space. Per host my chart has two bars that represent the instance (c: and d:). There is a space between each set that is like a visual delimiter for hosts.

index=os host="host1" OR host="host2" OR host="host3" object="LogicalDisk" counter="% Free Space" instance ="C:" OR instance ="D:" 
| eval percent_used=100-Value 
| chart latest(percent_used) by host, instance

How do I make the chart display a specified static order of hosts (pair of bars)?

Tags (1)
0 Karma

mayurr98
Super Champion

hey

have you tried looking at the visualisation for | chart latest(percent_used) over host by instance
Also try this

 index=os host="host1" OR host="host2" OR host="host3" object="LogicalDisk" counter="% Free Space" instance ="C:" OR instance ="D:" 
 | eval percent_used=100-Value 
 | stats  latest(percent_used) by host, instance | eval host=host." ".instance | fields- intance

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...