Splunk Search

Single Value Visualization

AC1
Engager

Hi all,

I am trying to use the Single Value Visualization in a dashboard to keep an all time running count of my field "id".

The issue I'm running into is I have duplicate logs for "id" that are giving me an incorrect number. When I am running a search with the SPL below and dedup I get the correct number of events. But when I try to convert that into the Visualization I am having issues. Any help is appreciated, thanks!

Index="xx" label="xx" id=* | dedup id

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AC1 ,

try something like this:

Index="xx" label="xx" id=* 
| stats dc(id) AS id_count

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Visualization only shows the value you give it so you need to search for the proper value.

As you have multiple values of the id field, it's no wonder that you'll get bad results if you expect just one value. So it's up to you to redefine the problem. If you want to somehow decide to return just one of those ids, you have to make that choice.

BTW "dedup id" will still return multiple values if you have multiple ids. So please define your desired result more precisely.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...