Splunk Search

How do I get the dashboard to show  ONLY the highest count for the day?

woodlandrelic
Path Finder

HI 

So I have this dashboard showing the below. 

HBSS      ACAS        CMRSACAS    CMRSHBSS
89              92               84                          77

MY question is how do I get the dashboard to show  ONLY the highest count for the day. Since the dashboard are updated daily? Any help will be fantastic.

Thanks

Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

It would be helpful if you could share some of your upstream SPL (and maybe even some sample data). This might help us to generate efficient SPL for your use-case.

That being said, here is a way to convert the table you provided into the largest device count.

 

| transpose column_name=devices
| rename "row 1" as count
| eventstats max(count) as max_count
| where count=max_count

 

This has the ability to return multiple rows if they have the largest count in common. You could use | head 1 after to limit it to one result.

View solution in original post

Tom_Lundie
Contributor

It would be helpful if you could share some of your upstream SPL (and maybe even some sample data). This might help us to generate efficient SPL for your use-case.

That being said, here is a way to convert the table you provided into the largest device count.

 

| transpose column_name=devices
| rename "row 1" as count
| eventstats max(count) as max_count
| where count=max_count

 

This has the ability to return multiple rows if they have the largest count in common. You could use | head 1 after to limit it to one result.

woodlandrelic
Path Finder

Hi @Tom_Lundie 

So I figure it out and replace the individual search with
 |search system_id=$system_id$

| transpose column_name=devices
| rename "row 2" as count
| eventstats max(count) as max_count
| where count=max_count
| table max_count
| head 1

 

 

Thank you very much

Tags (1)
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...