Splunk Enterprise

Can we use only static values or is it possible to use dynamic values from a radar search?

jip31
Motivator

Hi!

Concerning the chart radar, I would like to know if we have to use only static values like below or if it is possible to use dynamic values from a search?

 

 

 

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"

 

 

 

If we can use only static values, how to combine many different key?

thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

See the example given with the app

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"| append
    [| makeresults
    | eval key="better", "Business Value"=9.37, Enablement=2.64, Foundations=4.56, Governance=6.68, "Operational Excellence"=9.992, "Community"=9.66 
    | untable key,"axis","value" 
    | eval keyColor="#33FF55"
        ]

 You have two different keys with two different keyColor values. The limitation is that single key has to have one keyColor value.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

See the example given with the app

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"| append
    [| makeresults
    | eval key="better", "Business Value"=9.37, Enablement=2.64, Foundations=4.56, Governance=6.68, "Operational Excellence"=9.992, "Community"=9.66 
    | untable key,"axis","value" 
    | eval keyColor="#33FF55"
        ]

 You have two different keys with two different keyColor values. The limitation is that single key has to have one keyColor value.

0 Karma

jip31
Motivator

Perfect, I didn't thought to use append.... thanks

0 Karma

jip31
Motivator

is anybody can't help please?

 
 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What have you tried?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...