Splunk Enterprise

Can I Pass Values to Single Value Panel?

josephjohn2211
Engager

Hello All,

I'm new to Splunk. I have the below table. I want to show the Previous Month Actual Cost in a single value panel, and the difference as a subscript and trend showing it is increased or decreased comparing to Current Month Forecast CostSplunk Question.png

How can I structure the Simple XML to get the desired output?

Labels (1)
0 Karma
1 Solution

PaulPanther
Builder

Ah, okay.

Please test below search query. The lookup must contain a timestamp of the forecasted month that is used by the timechart.

 

 

 

index=azure_cost_management earliest=-6mon@mon latest=@mon
|append [
| inputlookup MyAzureSubscription-forecast_cost.csv 
| rename Cost AS CostInBillingCurrency    
| eval _time=strptime(UsageDate,"%Y%m%d")
]
 | timechart span=1month sum(CostInBillingCurrency) by SubscriptionName

 

 

 

 

View solution in original post

0 Karma

PaulPanther
Builder

@josephjohn2211 Please provide your current search

0 Karma

josephjohn2211
Engager

"index=azure_cost_management earliest=-1mon@mon latest=@mon
| eventstats sum(CostInBillingCurrency) as PreviousMonthActualCost 
| head 1
| table PreviousMonthActualCost, SubscriptionName 
| join type=inner SubscriptionName 
    [| inputlookup MyAzureSubscription-forecast_cost.csv 
     | stats sum(Cost) as CurrentMonthForecastCost by SubscriptionName
     | table CurrentMonthForecastCost, SubscriptionName]
| eval Difference=PreviousMonthActualCost - CurrentMonthForecastCost
| table PreviousMonthActualCost, CurrentMonthForecastCost, Difference,SubscriptionName" 

Here Actual Cost and Forecast Cost are retrieved using Different APIs from Azure Cost Management

0 Karma

PaulPanther
Builder

Following search would be the easiest solution but based on your data retention policies and amount of events  it may make sense to use a summary index or a lookup as you already do it.

index=azure_cost_management earliest=-6mon@mon latest=@mon
 | timechart span=1month sum(CostInBillingCurrency) by SubscriptionName

To split by SubscriptionName use Trellis as described here: Use trellis layout to split visualizations - Splunk Documentation

PaulPanther_0-1675755790352.png

 

0 Karma

josephjohn2211
Engager

The above query helps, but it compares the actual cost of Current Month with Previous Month. I wanted to compare the actual cost of Previous Month and Forecasted Cost of Current Month. Here Actual Cost Data is retrieved from the index and forecasted cost is retrieved from the lookup. Any suggestions on how can I edit the query to get the desired output

0 Karma

PaulPanther
Builder

Ah, okay.

Please test below search query. The lookup must contain a timestamp of the forecasted month that is used by the timechart.

 

 

 

index=azure_cost_management earliest=-6mon@mon latest=@mon
|append [
| inputlookup MyAzureSubscription-forecast_cost.csv 
| rename Cost AS CostInBillingCurrency    
| eval _time=strptime(UsageDate,"%Y%m%d")
]
 | timechart span=1month sum(CostInBillingCurrency) by SubscriptionName

 

 

 

 

0 Karma

josephjohn2211
Engager

 

The above query is not working as expected. My Lookup Looks Like this and in my index the Date field  is in ("%m/%d/%Y" - 02/01/2023). The _time uses the filed Date during indexingSplunk Lookup.png

0 Karma

PaulPanther
Builder

I edited my previous post and added strptime command. Please check it again.

0 Karma

josephjohn2211
Engager

Thanks Paul. It works. I truly appreciate your help.  Is there any way to show the former value instead of the later one in the visualizationSplunk Lookup.png

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...