Splunk Search

radial/marker/and filler gauge viualistions + controlling the ranges dynamically


I am looking at the radial/marker/and filler gauge viualistions.

As I understand it I have to have my search so that there is only one value present in the stats tab, done with a serach like this:
... | stats max(kpi1) as KpiName in this case it is 377.12

And this produces something like this for the filler gauge (similar for radial/marker gauges):

<a href="http://tinypic.com?ref=2zgrjw8" target="_blank"><img src="http://i57.tinypic.com/2zgrjw8.jpg" border="0" alt="Image and video hosting by TinyPic"></a>

Now what I want is to be able to contol the max value (i.e. 500 in this case) of the gauge dynmically?
THe way to do this currently is go into format and adjust the colour ranges accordingly, I want to make this more dynamic.
Can I do something like this by having this extra value produced from my search? The field is available in the dataset.

Also, but I may ask this in another questions is how can I show the % value(i.e. 377.12/500*100 =75%) here also. Can this be done using the search or do i have to use advanced XML or even HTML.

0 Karma


Some options provided in a similar question

0 Karma


tks will have a look at that
Found this here which helped me get a better grasp of it.
index=_internal earliest=-5m sourcetype=splunkd | stats count | gauge count [search sourcetype=splunkd index=_internal earliest=-20m latest=-10m | stats count as max | eval first=0 | eval second=10 | eval third=max/2 | eval fourth=max | eval range=first+" "+second+" "+third+" "+fourth | return $range]

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.