Dashboards & Visualizations

$ sign in search works but not in dashboards

andrei1bc
Communicator

My Search

index=_introspection host=*  component=Hostwide
| eval percentage=(round((($data.mem_used$/$data.mem$)*100), 2))
| eval total_mem=(round(($data.mem$/1024), 2))." Gb"
| eval used_mem=(round(($data.mem_used$/1024), 2))." Gb"
| where percentage>=95
| stats first(total_mem) as "Total Memory", first(used_mem) as "In Use", first(percentage) as "% Used" by host

Result

   host             Total Memory    In Use     % Used
   xx1          31.99 Gb        31.10 Gb       97.23
   xx2              4.00 Gb         3.93 Gb        98.33 

Issue :

If i save this search in a dashboard panel the table will show "waiting for input" due to the presence of the $ character in my search. Can i replace that character with a different one ?

Thank you in advance

Tags (1)
0 Karma
1 Solution

andrei1bc
Communicator

Never mind. I am an idiot. It works if you put double $ .

 index=_introspection host=*  component=Hostwide
 | eval percentage=(round((($$data.mem_used$$/$$data.mem$$)*100), 2))
 | eval total_mem=(round(($$data.mem$$/1024), 2))." Gb"
 | eval used_mem=(round(($$data.mem_used$$/1024), 2))." Gb"
 | where percentage>=95
 | stats first(total_mem) as "Total Memory", first(used_mem) as "In Use", first(percentage) as "% Used" by host

View solution in original post

0 Karma

andrei1bc
Communicator

Never mind. I am an idiot. It works if you put double $ .

 index=_introspection host=*  component=Hostwide
 | eval percentage=(round((($$data.mem_used$$/$$data.mem$$)*100), 2))
 | eval total_mem=(round(($$data.mem$$/1024), 2))." Gb"
 | eval used_mem=(round(($$data.mem_used$$/1024), 2))." Gb"
 | where percentage>=95
 | stats first(total_mem) as "Total Memory", first(used_mem) as "In Use", first(percentage) as "% Used" by host
0 Karma

jkat54
SplunkTrust
SplunkTrust

Hey, I converted your comment to the answer. Please mark it as such.

No one will be upset that you answered your own question. It happens all the time!

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...