Splunk Search

How to use stats or chart by multiple columns while using visualizations?

AK89
Explorer

Here is the sample data set:

ENTITY_NAME REPLICATION_OF VALUE
server1 BackupA 59
server2 BackupB 28
server3 backup_noenc_h1 54
server3 backup_utility_h1 96
server4 backup_noenc_h2 40
server4 backup_utility_h2 700

 

I want to be able to use the number display visualization to display entity_name, replication_of, and latest value for each record. I've tried these:

| stats latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) over REPLICATION_OF by ENTITY_NAME

Ultimately I want something that looks like this, but not sure if you can display three data series in a number display. If this isn't possible, what would be the best way to visualize a data set like this?

AK89_0-1659056729061.png

 

 

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

AK89
Explorer

This worked great for my number display, but I can't seem to get it to work on the radial gauges like your screenshot. Did you have to do something else to get it to populate multiple gauges? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm not aware of any special setting.  I'm using a 9.0.0 installation.  After the stats, Splunk visualization automatically selected "Radial Gauge".  All I did is select trellis.

Screen Shot 2022-07-29 at 9.17.27 PM.png

By default, radial gauge uses the "shiny" skin; another skin (style) is "minimal", like this

Screen Shot 2022-07-29 at 9.15.35 PM.png

0 Karma

AK89
Explorer

I thought of trying something like that last night (combining the values into one field) but couldn't get it to work. Thanks a lot, this accomplishes what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...