Splunk Search

help on coloring a threshold number with a unit value

jip31
Motivator

hi

I use a search wich add a unit value at the end of the result (GB)

| eval FreeSpace=FreeSpace." GB", TotalSpace=TotalSpace." GB" 

I need to use a threshold coloring on this value but it doesnt works due to the unit value at the end...

      <colorPalette type="list">[#DC4E41,#F1813F,#53A051]</colorPalette>
      <scale type="threshold">10,80</scale>
    </format>

what i have to do please??

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this sample

<dashboard>
  <label>table</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count by sourcetype </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <format type="number" field="count">
           <option name="precision">0</option>
          <option name="useThousandSeparators">false</option>
          <option name="unit">GB</option>
          <option name="unitPosition">after</option>
        </format>
        <format type="color" field="count">
          <colorPalette type="list">[#DC4E41,#F1813F,#53A051]</colorPalette>
          <scale type="threshold">0,30,70,100</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this sample

<dashboard>
  <label>table</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count by sourcetype </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <format type="number" field="count">
           <option name="precision">0</option>
          <option name="useThousandSeparators">false</option>
          <option name="unit">GB</option>
          <option name="unitPosition">after</option>
        </format>
        <format type="color" field="count">
          <colorPalette type="list">[#DC4E41,#F1813F,#53A051]</colorPalette>
          <scale type="threshold">0,30,70,100</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

jip31
Motivator

It doesnt works
stats latest(time) as time latest(FreeSpace) as FreeSpace by host
| eval FreeSpace=FreeSpace." GB", TotalSpace=TotalSpace." GB"
| rename FreeSpace as "Free space"

 <format type="number" field="Free space">
           <option name="useThousandSeparators">false</option>
           <option name="unit">GB</option>
           <option name="unitPosition">after</option>
         </format>
         <format type="color" field="Free space">
           <colorPalette type="list">[#DC4E41,#F1813F,#53A051]</colorPalette>
           <scale type="threshold">0,10,20,100</scale>
         </format>
0 Karma

vnravikumar
Champion

Hi
Remove | eval FreeSpace=FreeSpace." GB", TotalSpace=TotalSpace." GB" from your query and check

0 Karma

jip31
Motivator

ok thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...