Dashboards & Visualizations

How to set high number in gauge

msarro
Builder

Hey everyone. I have a data source which contains license usage information.
Each source contains a line like this:

Group License: 10 of 123453 used.

I am capturing these using a regex, as shown below. I want to use a marker gauge to show this data on a dashboard. However when I try to do this, the gauge tops out at 100. Since the number can vary (the licenses are based on a number of feature licenses, so the amount can vary) I can't hardcode the intervals of the gauge. Is there any way to override this behavior? The wiki page for gauges is basically barren.

sourcetype="AS_LICENSE_FILE" host=as1.commercial.mylab.net
    | rex "(?i)Key: Group.*? \- (?P<GROUP_LICENSE_USED>\d+)(?= )"   
    | rex "(?i)Key: Gr.+ of (?P<GROUP_LICENSE_AVAIL>\d+)"
    |gauge  GROUP_LICENSE_USED GROUP_LICENSE_AVAIL
Tags (2)
0 Karma
1 Solution

msarro
Builder
sourcetype="AS_LICENSE_FILE" host=as1.mylab.net
    | rex "(?i)Key: Group.*? \- (?P<GROUP_LICENSE_USED>\d+)(?= )"   
    | rex "(?i)Key: Gr.+ of (?P<GROUP_LICENSE_AVAIL>\d+)"
    |eval p1=round(GROUP_LICENSE_AVAIL/3)
    |eval p2=round(p1*2)
    |gauge  GROUP_LICENSE_USED 0  p1 p2 GROUP_LICENSE_AVAIL

I resolved this by changing it as shown above. Apparently you have to set all of the data points automatically? Is this correct?

View solution in original post

msarro
Builder
sourcetype="AS_LICENSE_FILE" host=as1.mylab.net
    | rex "(?i)Key: Group.*? \- (?P<GROUP_LICENSE_USED>\d+)(?= )"   
    | rex "(?i)Key: Gr.+ of (?P<GROUP_LICENSE_AVAIL>\d+)"
    |eval p1=round(GROUP_LICENSE_AVAIL/3)
    |eval p2=round(p1*2)
    |gauge  GROUP_LICENSE_USED 0  p1 p2 GROUP_LICENSE_AVAIL

I resolved this by changing it as shown above. Apparently you have to set all of the data points automatically? Is this correct?

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...