Splunk Search

How to specify a particular aggregate value in query for Single Value Visualization Chart?

jaj
Path Finder

how do i specify a particular value to be displayed in single value visualization chart? i only want the totalCount (success+errors) to display as the single value in the chart:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") | 
dedup requestMarker | 
stats count(eval(searchmatch("purchase success"))) as successCount 
      count(eval(searchmatch("purchase failed"))) as errorCount |
eval totalCount = successCount + errorCount
0 Karma
1 Solution

niketn
Legend

@jaj why not try just | stats count as totalCount? You have already filtered the required events:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") 
| dedup requestMarker
| stats count as totalCount
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@jaj why not try just | stats count as totalCount? You have already filtered the required events:

index=nonprod_applogs source="*test.log*" ("purchase success")  OR ("purchase failed") 
| dedup requestMarker
| stats count as totalCount
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jaj
Path Finder

@niketnilay dang yes very true for totalCount thank you :bow:

0 Karma

dkeck
Influencer

HI,

I want to rewrite my previous answer:

try this. either add to your XML code on your dashboard the option field have a look at the link under "single value"

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/PanelreferenceforSimplifiedXML#single_value

or use the SPL command | fields totalCount within your single value search on the dashboard

jaj
Path Finder

hi @dkeck! i appended that to the end of the query but it's only displaying "1"

0 Karma

dkeck
Influencer

updated my answer 🙂

0 Karma

jaj
Path Finder

@dkeck cool thanks for the amended response! :thumbsup:

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...