Splunk Search

How to use stats or chart by multiple columns while using visualizations?

AK89
Explorer

Here is the sample data set:

ENTITY_NAME REPLICATION_OF VALUE
server1 BackupA 59
server2 BackupB 28
server3 backup_noenc_h1 54
server3 backup_utility_h1 96
server4 backup_noenc_h2 40
server4 backup_utility_h2 700

 

I want to be able to use the number display visualization to display entity_name, replication_of, and latest value for each record. I've tried these:

| stats latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) over REPLICATION_OF by ENTITY_NAME

Ultimately I want something that looks like this, but not sure if you can display three data series in a number display. If this isn't possible, what would be the best way to visualize a data set like this?

AK89_0-1659056729061.png

 

 

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

AK89
Explorer

This worked great for my number display, but I can't seem to get it to work on the radial gauges like your screenshot. Did you have to do something else to get it to populate multiple gauges? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm not aware of any special setting.  I'm using a 9.0.0 installation.  After the stats, Splunk visualization automatically selected "Radial Gauge".  All I did is select trellis.

Screen Shot 2022-07-29 at 9.17.27 PM.png

By default, radial gauge uses the "shiny" skin; another skin (style) is "minimal", like this

Screen Shot 2022-07-29 at 9.15.35 PM.png

0 Karma

AK89
Explorer

I thought of trying something like that last night (combining the values into one field) but couldn't get it to work. Thanks a lot, this accomplishes what I was looking for!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...