Splunk Search

Single value visualization on mutliple-series result

Simon
Contributor

I have a search using the rangemap command which generates a table with three fields, e.g.:

domain | uptime | range
example.com | 99.5 | yellow
mydomain.com | 99.999 | green
anotherdomain.com | 99.2 | red

Is there a way to get a single value visualization on each series to include in a dashboard, either with simple or advanced xml?

Thanks
Simon

Tags (3)
0 Karma
1 Solution

melting
Splunk Employee
Splunk Employee

I think that is a great idea.

I have done something similar to this by separating the range into several series, where each entry only shows up in one series, then using stackmode "stacked". This can be done in either simple or advanced xml. Take a look at the table I would try to create:

domain | red | yellow | green 
example.com | 0 | 1 | 0
mydomain.com | 0 | 0 | 1
anotherdomain.com | 1 | 0 | 0

Step 1 - search:

index=_internal | stats count by sourcetype | rangemap field=count green=0-100 yellow=101-1000 default=red | eval red=if(range=="red", 1, 0) | eval yellow=if(range=="yellow", 1, 0) | eval green=if(range=="green", 1, 0) | table sourcetype red yellow green

Step 2 - graph - add this to a panel in a dashboard and edit visualization to be column in stacked mode

Step 3 - change the series color to match - check the docs here

View solution in original post

melting
Splunk Employee
Splunk Employee

I think that is a great idea.

I have done something similar to this by separating the range into several series, where each entry only shows up in one series, then using stackmode "stacked". This can be done in either simple or advanced xml. Take a look at the table I would try to create:

domain | red | yellow | green 
example.com | 0 | 1 | 0
mydomain.com | 0 | 0 | 1
anotherdomain.com | 1 | 0 | 0

Step 1 - search:

index=_internal | stats count by sourcetype | rangemap field=count green=0-100 yellow=101-1000 default=red | eval red=if(range=="red", 1, 0) | eval yellow=if(range=="yellow", 1, 0) | eval green=if(range=="green", 1, 0) | table sourcetype red yellow green

Step 2 - graph - add this to a panel in a dashboard and edit visualization to be column in stacked mode

Step 3 - change the series color to match - check the docs here

Simon
Contributor

This is a great solution, thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...