Splunk ITSI

i want to display multiple fields in single value display, how to display multiple fields in single value display panal (CPU,Disk Space,RAM)

mahendra559
New Member

i want to display multiple fields in single value display, how to display multiple fields in single value display panal (CPU,Disk Space,RAM)

Labels (2)
0 Karma

to4kawa
Ultra Champion
Env perc
CPU 80
Disk_Space  90
RAM 20

you should make table.
after that,
| stats values(*) as * by Env
Visualization > Single Value with Trellis

0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

to4kawa
Ultra Champion

Have you try this? How is it?
all these 3 names in one single value panel with colors and percentage
you want three but single. I think single means one, isn't it?

0 Karma

woodcock
Esteemed Legend

Trellis is the only native way to do this: 1 panel but multiple related visualizations in that 1 panel.

0 Karma

woodcock
Esteemed Legend
0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

woodcock
Esteemed Legend

That is EXACTLY what trellis does. Do your homework.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mahendra559,
you should try to use a Poste Process Search to have the results you want and to display in different single panels, see the below example:

<dashboard>
  <label>Multi single panel</label>
  <search id="my_search">
    <query>
      | makeresults 
      | eval CPU="2", RAM="32GB", disk="1TB"
    </query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <single>
        <title>CPU</title>
        <search base="my_search">
          <query>
            | table CPU 
          </query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>RAM</title>
        <search base="my_search">
          <query>
            | table RAM 
          </query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Disk</title>
        <search base="my_search">
          <query>
            | table disk 
          </query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>

Ciao.
Giuseppe

0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

sumanssah
Communicator

Can you please share more details on the requirement.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What I've done in the past is combine multiple fields (usually just two) into a single field using the . operator.

... | eval foo = bar . ":" . baz
---
If this reply helps you, Karma would be appreciated.
0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I love how requirements change after answers are provided. What you want to do is not possible with one single-value panel.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...