Dashboards & Visualizations

$ sign in search works but not in dashboards

andrei1bc
Communicator

My Search

index=_introspection host=*  component=Hostwide
| eval percentage=(round((($data.mem_used$/$data.mem$)*100), 2))
| eval total_mem=(round(($data.mem$/1024), 2))." Gb"
| eval used_mem=(round(($data.mem_used$/1024), 2))." Gb"
| where percentage>=95
| stats first(total_mem) as "Total Memory", first(used_mem) as "In Use", first(percentage) as "% Used" by host

Result

   host             Total Memory    In Use     % Used
   xx1          31.99 Gb        31.10 Gb       97.23
   xx2              4.00 Gb         3.93 Gb        98.33 

Issue :

If i save this search in a dashboard panel the table will show "waiting for input" due to the presence of the $ character in my search. Can i replace that character with a different one ?

Thank you in advance

Tags (1)
0 Karma
1 Solution

andrei1bc
Communicator

Never mind. I am an idiot. It works if you put double $ .

 index=_introspection host=*  component=Hostwide
 | eval percentage=(round((($$data.mem_used$$/$$data.mem$$)*100), 2))
 | eval total_mem=(round(($$data.mem$$/1024), 2))." Gb"
 | eval used_mem=(round(($$data.mem_used$$/1024), 2))." Gb"
 | where percentage>=95
 | stats first(total_mem) as "Total Memory", first(used_mem) as "In Use", first(percentage) as "% Used" by host

View solution in original post

0 Karma

andrei1bc
Communicator

Never mind. I am an idiot. It works if you put double $ .

 index=_introspection host=*  component=Hostwide
 | eval percentage=(round((($$data.mem_used$$/$$data.mem$$)*100), 2))
 | eval total_mem=(round(($$data.mem$$/1024), 2))." Gb"
 | eval used_mem=(round(($$data.mem_used$$/1024), 2))." Gb"
 | where percentage>=95
 | stats first(total_mem) as "Total Memory", first(used_mem) as "In Use", first(percentage) as "% Used" by host
0 Karma

jkat54
SplunkTrust
SplunkTrust

Hey, I converted your comment to the answer. Please mark it as such.

No one will be upset that you answered your own question. It happens all the time!

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...