Unable to visualize the dashboard as per the requirement

[shenoyveer]

Hi Everyone,

I am trying to create one dashboard out of search query but I am getting stuck where I am unable to the host details in the dashboard.

query is - 

index="vm-details" | eval date=strftime(_time, "%Y-%m-%d")
| stats dc(host) as host_count, values(host) as hosts by date | sort date

I am getting host_count and date in dashboard but my requirement is I need hostname should come while hovering host_count

I tried using values(host) directly but that didnt work.

can someone help?

CC: @ITWhisperer 

Thanks,
Veeresh Shenoy S

[kiran_panchavat · Accepted solution]

@shenoyveer You can use trellis, split by host. 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

[shenoyveer]

Thanks Kiran 🙂

[kiran_panchavat]

@shenoyveer 

If you take out the eval from the query, you must also remove the date field from it.

index="vm-details"
| timechart count by host

[shenoyveer]

is there any alternative to timechart?

I want to have particular date in x axis

[kiran_panchavat]

@shenoyveer 

Can you check this? 

The x-axis will be the first column/field in the results, so put the date as the first field after the by.

[shenoyveer]

Tried with another query too

index="testing" | eval date=strftime(_time, "%Y-%m-%d") | stats count by date, host

but still its not showing hostname in dashboard

[kiran_panchavat]

@shenoyveer   Try this and see if it meets your requirements. You can remove | eval date=strftime(_time, "%Y-%m-%d")

[isoutamo]

Please write all SPL etc. inside </> tags. That way those are easier to take into use. It also ensure that we can get the same SPL what you have write into your example.

[shenoyveer]

Hi Kiran,

Thanks for the prompt reply. Its not working for me and after removing eval no data popping up.

 my goad is to get the hostname while hovering the host_count variable from query