Splunk Search

how to use horseshoe meter with stats

kirrusk
Communicator

how to use horseshoe meter for below query

index = *   | table podname cluster status | dedup podname cluster status |  eval A=if(like(status,"%True"), "1", "0")  | stats count(eval(A=1)) as success  | stats count(eval(A=0))  as failure

I want to display horseshoe meter in splunkdashboard like below

 

success/failure   (3/0)

if there failure count increased like (2/1)

then change the meter color , Can anyone please suggest how i can achieve this

 

 

 

 

 

Labels (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kirrusk 

 

You can check this example.

<dashboard>
  <row>
    <panel>
      <viz type="horseshoe_meter_app.horseshoe_meter">
        <search>
          <done>
            <condition match="$result.flag$ == 0">
              <set token="hs_Color">#FF0000</set>
            </condition>
            <condition>
              <set token="hs_Color">#00FF00</set>
            </condition>
          </done>
          <query>| makeresults | eval A="1,1,0,0,0", A=split(A,",") | mvexpand A | stats count(eval(A=1)) as success count(eval(A=0)) as failure | eval flag=if(success&gt;failure,1,0)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="horseshoe_meter_app.horseshoe_meter.valueColor">$hs_Color$</option>
        <option name="refresh.display">progressbar</option>
      </viz>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...