Splunk Search

How to use stats or chart by multiple columns while using visualizations?

AK89
Explorer

Here is the sample data set:

ENTITY_NAME REPLICATION_OF VALUE
server1 BackupA 59
server2 BackupB 28
server3 backup_noenc_h1 54
server3 backup_utility_h1 96
server4 backup_noenc_h2 40
server4 backup_utility_h2 700

 

I want to be able to use the number display visualization to display entity_name, replication_of, and latest value for each record. I've tried these:

| stats latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) by REPLICATION_OF ENTITY_NAME
| chart latest(VALUE) over REPLICATION_OF by ENTITY_NAME

Ultimately I want something that looks like this, but not sure if you can display three data series in a number display. If this isn't possible, what would be the best way to visualize a data set like this?

AK89_0-1659056729061.png

 

 

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Screen Shot 2022-07-28 at 8.53.35 PM.pngIf the main consideration is display, I have this really silly trick:

 

| eval label = REPLICATION_OF . " - " . ENTITY_NAME
| stats latest(VALUE) by label

 

AK89
Explorer

This worked great for my number display, but I can't seem to get it to work on the radial gauges like your screenshot. Did you have to do something else to get it to populate multiple gauges? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm not aware of any special setting.  I'm using a 9.0.0 installation.  After the stats, Splunk visualization automatically selected "Radial Gauge".  All I did is select trellis.

Screen Shot 2022-07-29 at 9.17.27 PM.png

By default, radial gauge uses the "shiny" skin; another skin (style) is "minimal", like this

Screen Shot 2022-07-29 at 9.15.35 PM.png

0 Karma

AK89
Explorer

I thought of trying something like that last night (combining the values into one field) but couldn't get it to work. Thanks a lot, this accomplishes what I was looking for!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...