Dashboards & Visualizations

compare 2 values and color in dashboard if no match

Adacats
Engager

I am using dashboard studio and i want to compare 2 values and if they are different, highlight it red. What is the best vizualization type for this, and how do i have it color based on the comparison of the 2 values?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these two values in the same event, in the same field e.g.  in a multivalue field, in the same field on different events, the result of two different aggregations, values from two different time periods? Please provide more details of what you are trying to achieve.

Also, does it have to be Studio or would a Classic dashboard solution meet your needs?

0 Karma

Adacats
Engager

It is currently built out in studio so studio is needed.

They are different event codes in the same type of event (same field). I am comparing 200 code to 201 codes, and if they match, make it green, if the count differs, then red.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current search, preferably in a codeblock </>

Also, what do you want to be made green?

0 Karma

Adacats
Engager

Code has been sanitized of identifying info, note this is filtering just on event code 200, but original search is filtered on both 200 and 201 event codes

index=wineventlog source="WinEventLog:Application" (SourceName=ABC OR SourceName=DEF) Message="*$Projlookup$*" *$openfilter$*
                  [
          | inputlookup csvfile.csv 
          | search Environment="$envlookup$" Hostname IN ( $hostname$)
          | fields Hostname Message EventCode
          | rename Hostname as host 
          ]  
            | search (EventCode=200)
            | stats count by EventCode

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...