Dashboards & Visualizations

compare 2 values and color in dashboard if no match

Adacats
Engager

I am using dashboard studio and i want to compare 2 values and if they are different, highlight it red. What is the best vizualization type for this, and how do i have it color based on the comparison of the 2 values?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these two values in the same event, in the same field e.g.  in a multivalue field, in the same field on different events, the result of two different aggregations, values from two different time periods? Please provide more details of what you are trying to achieve.

Also, does it have to be Studio or would a Classic dashboard solution meet your needs?

0 Karma

Adacats
Engager

It is currently built out in studio so studio is needed.

They are different event codes in the same type of event (same field). I am comparing 200 code to 201 codes, and if they match, make it green, if the count differs, then red.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current search, preferably in a codeblock </>

Also, what do you want to be made green?

0 Karma

Adacats
Engager

Code has been sanitized of identifying info, note this is filtering just on event code 200, but original search is filtered on both 200 and 201 event codes

index=wineventlog source="WinEventLog:Application" (SourceName=ABC OR SourceName=DEF) Message="*$Projlookup$*" *$openfilter$*
                  [
          | inputlookup csvfile.csv 
          | search Environment="$envlookup$" Hostname IN ( $hostname$)
          | fields Hostname Message EventCode
          | rename Hostname as host 
          ]  
            | search (EventCode=200)
            | stats count by EventCode

 

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...