Splunk Search

How to specify a particular aggregate value in query for Single Value Visualization Chart?

jaj
Path Finder

how do i specify a particular value to be displayed in single value visualization chart? i only want the totalCount (success+errors) to display as the single value in the chart:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") | 
dedup requestMarker | 
stats count(eval(searchmatch("purchase success"))) as successCount 
      count(eval(searchmatch("purchase failed"))) as errorCount |
eval totalCount = successCount + errorCount
0 Karma
1 Solution

niketnilay
Legend

@jaj why not try just | stats count as totalCount? You have already filtered the required events:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") 
| dedup requestMarker
| stats count as totalCount
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@jaj why not try just | stats count as totalCount? You have already filtered the required events:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") 
| dedup requestMarker
| stats count as totalCount
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jaj
Path Finder

@niketnilay dang yes very true for totalCount thank you :bow:

0 Karma

dkeck
Influencer

HI,

I want to rewrite my previous answer:

try this. either add to your XML code on your dashboard the option field have a look at the link under "single value"

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/PanelreferenceforSimplifiedXML#single_value

or use the SPL command | fields totalCount within your single value search on the dashboard

jaj
Path Finder

hi @dkeck! i appended that to the end of the query but it's only displaying "1"

0 Karma

dkeck
Influencer

updated my answer 🙂

0 Karma

jaj
Path Finder

@dkeck cool thanks for the amended response! :thumbsup:

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...