Splunk Search

How to create radial gauges for each channel from this query ?

lsy9891
Engager

Hi,

I know that we can create radial gauges using aggregate values but I've selected the radial gauge visualization and it doesn't show for this query? How do we create radial gauges for each channel from this query?

earliest=-1d@d latest=@d index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?<type>.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X |  chart sum("#Errors") AS TotalError  BY Channel
0 Karma

maciep
Champion

I think the best you can do for that is to use the trellis layout option, which could create one radial gauge for each channel. The visualization itself isn't designed for multiple series.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...