Splunk Search

How can I combine 2 search strings onto 1 dashboard?

dhardingatn
New Member

I have 2 search strings that I am trying to combine to put on one dashboard.

sourcetype=snmp_ta host=* | eval fuel=case(ppscFuelLevel > 10000, 0, 1=1, ppscFuelLevel), FuelPct = fuel/100 | stats latest(FuelPct) 

and

sourcetype=snmp_ta host=* | eval fuel=case(fuelLevel > 10000, 0, 1=1, fuelLevel), FuelPct = fuel/100 | stats latest(FuelPct)

These strings are from different generators both reporting fuel levels.

Can you help?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

View solution in original post

0 Karma

somesoni2
Revered Legend

In final output, do you want to two columns, showing FuelPct for different criteria?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

0 Karma

dhardingatn
New Member

Thank You, I have the Fuel Percentage reporting on a Fuel Gauge to monitor the Fuel. It is working now so that I can combine 2 dashboards into one.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

No problem, glad to help.
FWIW, you can also replace the case function with an if: fuel=if(myFuelLevel > 10000, 0, myFuelLevel) since you only have one condition.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...