- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Everyone,
I am trying to create one dashboard out of search query but I am getting stuck where I am unable to the host details in the dashboard.
query is -
index="vm-details" | eval date=strftime(_time, "%Y-%m-%d")
| stats dc(host) as host_count, values(host) as hosts by date | sort date
I am getting host_count and date in dashboard but my requirement is I need hostname should come while hovering host_count
I tried using values(host) directly but that didnt work.
can someone help?
CC: @ITWhisperer
Thanks,
Veeresh Shenoy S
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@shenoyveer You can use trellis, split by host.
I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@shenoyveer You can use trellis, split by host.
I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Kiran 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you take out the eval from the query, you must also remove the date field from it.
index="vm-details"
| timechart count by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is there any alternative to timechart?
I want to have particular date in x axis
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you check this?
The x-axis will be the first column/field in the results, so put the date as the first field after the by.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tried with another query too
index="testing" | eval date=strftime(_time, "%Y-%m-%d") | stats count by date, host
but still its not showing hostname in dashboard
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@shenoyveer Try this and see if it meets your requirements. You can remove | eval date=strftime(_time, "%Y-%m-%d")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Please write all SPL etc. inside </> tags. That way those are easier to take into use. It also ensure that we can get the same SPL what you have write into your example.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Kiran,
Thanks for the prompt reply. Its not working for me and after removing eval no data popping up.
my goad is to get the hostname while hovering the host_count variable from query
