Splunk Search

How to create radial gauges for each channel from this query ?



I know that we can create radial gauges using aggregate values but I've selected the radial gauge visualization and it doesn't show for this query? How do we create radial gauges for each channel from this query?

earliest=-1d@d latest=@d index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?<type>.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X |  chart sum("#Errors") AS TotalError  BY Channel
0 Karma


I think the best you can do for that is to use the trellis layout option, which could create one radial gauge for each channel. The visualization itself isn't designed for multiple series.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!