Single Value Visualization

[AC1]

Hi all,

I am trying to use the Single Value Visualization in a dashboard to keep an all time running count of my field "id".

The issue I'm running into is I have duplicate logs for "id" that are giving me an incorrect number. When I am running a search with the SPL below and dedup I get the correct number of events. But when I try to convert that into the Visualization I am having issues. Any help is appreciated, thanks!

Index="xx" label="xx" id=* | dedup id

[gcusello]

Hi @AC1 ,

try something like this:

Index="xx" label="xx" id=* 
| stats dc(id) AS id_count

Ciao.

Giuseppe

[PickleRick]

Visualization only shows the value you give it so you need to search for the proper value.

As you have multiple values of the id field, it's no wonder that you'll get bad results if you expect just one value. So it's up to you to redefine the problem. If you want to somehow decide to return just one of those ids, you have to make that choice.

BTW "dedup id" will still return multiple values if you have multiple ids. So please define your desired result more precisely.