Splunk ITSI

i want to display multiple fields in single value display, how to display multiple fields in single value display panal (CPU,Disk Space,RAM)

mahendra559
New Member

i want to display multiple fields in single value display, how to display multiple fields in single value display panal (CPU,Disk Space,RAM)

Labels (2)
0 Karma

to4kawa
Ultra Champion
Env perc
CPU 80
Disk_Space  90
RAM 20

you should make table.
after that,
| stats values(*) as * by Env
Visualization > Single Value with Trellis

0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

to4kawa
Ultra Champion

Have you try this? How is it?
all these 3 names in one single value panel with colors and percentage
you want three but single. I think single means one, isn't it?

0 Karma

woodcock
Esteemed Legend

Trellis is the only native way to do this: 1 panel but multiple related visualizations in that 1 panel.

0 Karma

woodcock
Esteemed Legend
0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

woodcock
Esteemed Legend

That is EXACTLY what trellis does. Do your homework.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mahendra559,
you should try to use a Poste Process Search to have the results you want and to display in different single panels, see the below example:

<dashboard>
  <label>Multi single panel</label>
  <search id="my_search">
    <query>
      | makeresults 
      | eval CPU="2", RAM="32GB", disk="1TB"
    </query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <single>
        <title>CPU</title>
        <search base="my_search">
          <query>
            | table CPU 
          </query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>RAM</title>
        <search base="my_search">
          <query>
            | table RAM 
          </query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Disk</title>
        <search base="my_search">
          <query>
            | table disk 
          </query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>

Ciao.
Giuseppe

0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

sumanssah
Communicator

Can you please share more details on the requirement.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What I've done in the past is combine multiple fields (usually just two) into a single field using the . operator.

... | eval foo = bar . ":" . baz
---
If this reply helps you, Karma would be appreciated.
0 Karma

mahendra559
New Member

these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I love how requirements change after answers are provided. What you want to do is not possible with one single-value panel.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...