Dashboards & Visualizations

Stats for Values and count - Dashboard

rangarbus
Path Finder

Below are the events:

 

{
	"kubernetes" : {
	"pod_name" : "p1"
	},
	traceId: "t-1"
}

{
	"kubernetes" : {
	"pod_name" : "p1"
	},
	traceId: "t-2"
}

{
	"kubernetes" : {
	"pod_name" : "p2"
	},
	traceId: "t-4"
}

{
	"kubernetes" : {
	"pod_name" : "p3"
	},
	traceId: "t-5"
}

 

I am looking for a dashboard with 2 panels.

1. Showing the unique # of pods
2. Table with Pod Name, # of Number of unique traces

For the above event, panels will be

1. Showing the unique # of pods = 3

2. Table with Pod Name, # of Number of unique traces

 

   ----------------------------------
   | POD NAME   |  # of Traces      |
   ----------------------------------
   | p1         |  2                |
   ----------------------------------
   | p2         |  1                |
   ----------------------------------
   | p3         |  1                |
   ----------------------------------

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| spath path=kubernetes.pod_name output=pod_name
| spath path=traceId
| stats count by pod_name traceId
| stats count as number_of_traces by pod_name

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| spath path=kubernetes.pod_name output=pod_name
| spath path=traceId
| stats count by pod_name traceId
| stats count as number_of_traces by pod_name
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...