Splunk Search

How to display a gauge chart when null values are received?

qygoh
Engager

Hi guys i have a gauge chart which normally will display values. however i encounter issues when there is no value, how should i resolve it? i try with "noop" it seem like no working. Mind to share? Below is my search:

Customer="abc" Location="xyz"  ID2="EFF"  | eval Value=0.5 |stats avg(Value) as avgvalues | eval avgvalues=round(avgvalues,2)
| gauge avgvalues 0 0.6 1|noop

Thank you very much

0 Karma
1 Solution

You can run a base search and using preview (or finalized) search event handler, you can set calculated value for your Gauge Chart as a token. You can use $job.resultCount$ to identify "No Results Found" scenario and default the token to zero. See the example below, you may need to correct the base search as per what you have.

  <!--Base search for Gauge Chart with default 0 if null -->
  <search>
    <query>Customer="abc" Location="xyz"  ID2="EFF"  
  | eval Value=0.5 
  |stats avg(Value) as avgvalues 
  | eval avgvalues=round(avgvalues,2)
  </query>
    <earliest>@d</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <preview>
      <!--No results, default $gaugeValue$ to zero -->
      <condition match="$job.resultCount$==0">
        <set token="gaugeValue">0</set>
      </condition>
      <!--No results, default $gaugeValue$ from query -->
      <condition>
        <set token="gaugeValue">$result.avgvalues$</set>
      </condition>
    </preview>
  </search>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults 
| eval avgvalues =$gaugeValue$
| table avgvalues
| gauge avgvalues 0 0.6 1           
          </query>
          <earliest>-1m</earliest>
          <latest>now</latest>
        </search>
        ....
        ....
        ....

For reference, you can check out Null Search Swapper example in Splunk 6.x Dashboard Examples app.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

You can run a base search and using preview (or finalized) search event handler, you can set calculated value for your Gauge Chart as a token. You can use $job.resultCount$ to identify "No Results Found" scenario and default the token to zero. See the example below, you may need to correct the base search as per what you have.

  <!--Base search for Gauge Chart with default 0 if null -->
  <search>
    <query>Customer="abc" Location="xyz"  ID2="EFF"  
  | eval Value=0.5 
  |stats avg(Value) as avgvalues 
  | eval avgvalues=round(avgvalues,2)
  </query>
    <earliest>@d</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <preview>
      <!--No results, default $gaugeValue$ to zero -->
      <condition match="$job.resultCount$==0">
        <set token="gaugeValue">0</set>
      </condition>
      <!--No results, default $gaugeValue$ from query -->
      <condition>
        <set token="gaugeValue">$result.avgvalues$</set>
      </condition>
    </preview>
  </search>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults 
| eval avgvalues =$gaugeValue$
| table avgvalues
| gauge avgvalues 0 0.6 1           
          </query>
          <earliest>-1m</earliest>
          <latest>now</latest>
        </search>
        ....
        ....
        ....

For reference, you can check out Null Search Swapper example in Splunk 6.x Dashboard Examples app.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

qygoh
Engager

it working perfectly if i wish to change the chart to table i just have to use am i right?

0 Karma

@qygoh... table with single row... yes you can but with result.<fieldname> you can not only have single value even if the search returns multiple results. In other words you can replace the chart with either Single Value, Status Indicator(Custom Visualization), Other Gauges or HTML panel.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

qygoh
Engager

@niketnilay thank you very much for your help and suggestion

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...