Splunk Search
Highlighted

How to specify a particular aggregate value in query for Single Value Visualization Chart?

Path Finder

how do i specify a particular value to be displayed in single value visualization chart? i only want the totalCount (success+errors) to display as the single value in the chart:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") | 
dedup requestMarker | 
stats count(eval(searchmatch("purchase success"))) as successCount 
      count(eval(searchmatch("purchase failed"))) as errorCount |
eval totalCount = successCount + errorCount
0 Karma
Highlighted

Re: How to specify a particular aggregate value in query for Single Value Visualization Chart?

Influencer

HI,

I want to rewrite my previous answer:

try this. either add to your XML code on your dashboard the option field have a look at the link under "single value"

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/PanelreferenceforSimplifiedXML#single_value

or use the SPL command | fields totalCount within your single value search on the dashboard

Highlighted

Re: How to specify a particular aggregate value in query for Single Value Visualization Chart?

Path Finder

hi @dkeck! i appended that to the end of the query but it's only displaying "1"

0 Karma
Highlighted

Re: How to specify a particular aggregate value in query for Single Value Visualization Chart?

Influencer

updated my answer 🙂

0 Karma
Highlighted

Re: How to specify a particular aggregate value in query for Single Value Visualization Chart?

Path Finder

@dkeck cool thanks for the amended response! :thumbsup:

0 Karma
Highlighted

Re: How to specify a particular aggregate value in query for Single Value Visualization Chart?

Legend

@jaj why not try just | stats count as totalCount? You have already filtered the required events:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") 
| dedup requestMarker
| stats count as totalCount



| eval message="Happy Splunking!!!"


View solution in original post

Highlighted

Re: How to specify a particular aggregate value in query for Single Value Visualization Chart?

Path Finder

@niketnilay dang yes very true for totalCount thank you :bow:

0 Karma