Splunk Search

How to edit my search to get the output to show on a radial gauge?

TJ0214
New Member

I am trying to show the total amount of space we are using in a box right now for a dashboard. Here is my following serach, but I can't get the output to show on the needle. I was hoping it would work. Any ideas?

index=es_sec_box_ko sourcetype="box:users" | eval spaceUsed_GB=(space_used/1024/1024/1024) | where spaceUsed_GB >0 |stats latest(spaceUsed_GB) as spaceUsed_GB count by login |addcoltotals | sort -spaceUsed_GB

Thanks!

0 Karma

somesoni2
Revered Legend

Try something like this (little optimization done as well)

index=es_sec_box_ko sourcetype="box:users" space_used>0 |stats latest(space_used) as space_used by login  | eval spaceUsed_GB=(space_used/1024/1024/1024)| stats sum(spaceUsed_GB) as spaceUsed_GB
0 Karma

woodcock
Esteemed Legend

Try this:

index=es_sec_box_ko sourcetype="box:users" | dedup login | eval spaceUsed_GB=(space_used/1024/1024/1024) | stats sum(spaceUsed_GB) as total_spaceUsed_GB

This will produce a single value that should display in your single-value visualization.

0 Karma

woodcock
Esteemed Legend

What do you mean by "show on the needle"? If you mean some kind of single-value visualization, then you need to get rid of the by login part of your search because this causes stats to not produce a single value.

0 Karma

TJ0214
New Member

Im sorry I meant the radial gauge for a dashboard option does that help?

0 Karma

TJ0214
New Member

I took out by login and got no data.

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...