Splunk Search

How can I combine 2 search strings onto 1 dashboard?

dhardingatn
New Member

I have 2 search strings that I am trying to combine to put on one dashboard.

sourcetype=snmp_ta host=* | eval fuel=case(ppscFuelLevel > 10000, 0, 1=1, ppscFuelLevel), FuelPct = fuel/100 | stats latest(FuelPct) 

and

sourcetype=snmp_ta host=* | eval fuel=case(fuelLevel > 10000, 0, 1=1, fuelLevel), FuelPct = fuel/100 | stats latest(FuelPct)

These strings are from different generators both reporting fuel levels.

Can you help?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

View solution in original post

0 Karma

somesoni2
Revered Legend

In final output, do you want to two columns, showing FuelPct for different criteria?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

0 Karma

dhardingatn
New Member

Thank You, I have the Fuel Percentage reporting on a Fuel Gauge to monitor the Fuel. It is working now so that I can combine 2 dashboards into one.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

No problem, glad to help.
FWIW, you can also replace the case function with an if: fuel=if(myFuelLevel > 10000, 0, myFuelLevel) since you only have one condition.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...