Dashboards & Visualizations

compare 2 values and color in dashboard if no match

Adacats
Engager

I am using dashboard studio and i want to compare 2 values and if they are different, highlight it red. What is the best vizualization type for this, and how do i have it color based on the comparison of the 2 values?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these two values in the same event, in the same field e.g.  in a multivalue field, in the same field on different events, the result of two different aggregations, values from two different time periods? Please provide more details of what you are trying to achieve.

Also, does it have to be Studio or would a Classic dashboard solution meet your needs?

0 Karma

Adacats
Engager

It is currently built out in studio so studio is needed.

They are different event codes in the same type of event (same field). I am comparing 200 code to 201 codes, and if they match, make it green, if the count differs, then red.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current search, preferably in a codeblock </>

Also, what do you want to be made green?

0 Karma

Adacats
Engager

Code has been sanitized of identifying info, note this is filtering just on event code 200, but original search is filtered on both 200 and 201 event codes

index=wineventlog source="WinEventLog:Application" (SourceName=ABC OR SourceName=DEF) Message="*$Projlookup$*" *$openfilter$*
                  [
          | inputlookup csvfile.csv 
          | search Environment="$envlookup$" Hostname IN ( $hostname$)
          | fields Hostname Message EventCode
          | rename Hostname as host 
          ]  
            | search (EventCode=200)
            | stats count by EventCode

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...