Splunk Search

How can I combine 2 search strings onto 1 dashboard?

dhardingatn
New Member

I have 2 search strings that I am trying to combine to put on one dashboard.

sourcetype=snmp_ta host=* | eval fuel=case(ppscFuelLevel > 10000, 0, 1=1, ppscFuelLevel), FuelPct = fuel/100 | stats latest(FuelPct) 

and

sourcetype=snmp_ta host=* | eval fuel=case(fuelLevel > 10000, 0, 1=1, fuelLevel), FuelPct = fuel/100 | stats latest(FuelPct)

These strings are from different generators both reporting fuel levels.

Can you help?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

View solution in original post

0 Karma

somesoni2
Revered Legend

In final output, do you want to two columns, showing FuelPct for different criteria?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)

0 Karma

dhardingatn
New Member

Thank You, I have the Fuel Percentage reporting on a Fuel Gauge to monitor the Fuel. It is working now so that I can combine 2 dashboards into one.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

No problem, glad to help.
FWIW, you can also replace the case function with an if: fuel=if(myFuelLevel > 10000, 0, myFuelLevel) since you only have one condition.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...