Splunk Enterprise

Can we use only static values or is it possible to use dynamic values from a radar search?

jip31
Motivator

Hi!

Concerning the chart radar, I would like to know if we have to use only static values like below or if it is possible to use dynamic values from a search?

 

 

 

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"

 

 

 

If we can use only static values, how to combine many different key?

thanks

Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

See the example given with the app

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"| append
    [| makeresults
    | eval key="better", "Business Value"=9.37, Enablement=2.64, Foundations=4.56, Governance=6.68, "Operational Excellence"=9.992, "Community"=9.66 
    | untable key,"axis","value" 
    | eval keyColor="#33FF55"
        ]

 You have two different keys with two different keyColor values. The limitation is that single key has to have one keyColor value.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

See the example given with the app

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"| append
    [| makeresults
    | eval key="better", "Business Value"=9.37, Enablement=2.64, Foundations=4.56, Governance=6.68, "Operational Excellence"=9.992, "Community"=9.66 
    | untable key,"axis","value" 
    | eval keyColor="#33FF55"
        ]

 You have two different keys with two different keyColor values. The limitation is that single key has to have one keyColor value.

0 Karma

jip31
Motivator

Perfect, I didn't thought to use append.... thanks

0 Karma

jip31
Motivator

is anybody can't help please?

 
 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What have you tried?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...