Splunk Search

how to use horseshoe meter with stats

kirrusk
Communicator

how to use horseshoe meter for below query

index = *   | table podname cluster status | dedup podname cluster status |  eval A=if(like(status,"%True"), "1", "0")  | stats count(eval(A=1)) as success  | stats count(eval(A=0))  as failure

I want to display horseshoe meter in splunkdashboard like below

 

success/failure   (3/0)

if there failure count increased like (2/1)

then change the meter color , Can anyone please suggest how i can achieve this

 

 

 

 

 

Labels (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kirrusk 

 

You can check this example.

<dashboard>
  <row>
    <panel>
      <viz type="horseshoe_meter_app.horseshoe_meter">
        <search>
          <done>
            <condition match="$result.flag$ == 0">
              <set token="hs_Color">#FF0000</set>
            </condition>
            <condition>
              <set token="hs_Color">#00FF00</set>
            </condition>
          </done>
          <query>| makeresults | eval A="1,1,0,0,0", A=split(A,",") | mvexpand A | stats count(eval(A=1)) as success count(eval(A=0)) as failure | eval flag=if(success&gt;failure,1,0)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="horseshoe_meter_app.horseshoe_meter.valueColor">$hs_Color$</option>
        <option name="refresh.display">progressbar</option>
      </viz>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...