Dashboards & Visualizations

Need to create a dropdown to get result for a range of values

Mrig342
Contributor

Hi All,

I have a query to get the result of the list of filesystems and their respective disk usage details as below:

File_System  Total in GB   Used in GB   Available in GB   Disk_Usage in %
/var                   10                    9.2                   0.8                           92
/opt                   10                    8.1                   1.9                          81
/logs                 10                    8.7                   1.3                          87
/apps                10                    8.4                   1.6                          84
/pcvs                10                    9.4                    0.6                         94

I need to create a dropdown with the disk usage values to get the above table for a range of values. For e.g. If I select 80 in the dropdown it will show the table with values of disk usage in the range 80-84, then if I select 85 in the dropdown it will show the table with values of disk usage in the range 85-89 and so on. I created the dropdown with token as "DU" and created the search query for the table as:

.... | search Disk_Usage=$DU$
| table File_System,Total,Used,Available,Disk_Usage
| rename Total as "Total in GB" Used as "Used in GB" Available as "Available in GB" Disk_Usage as "Disk_Usage in %"

But with this query I am able to get the table for a single disk usage value only. Please help me create a query so that upon selecting an option in the dropdown will give the table for a range of disk usage values.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're getting a single value because that's what you asked for with "Disk_Usage=$DU$".  To get a range of values, use >= and <.

.... | where (Disk_Usage>=$DU$ AND Disk_Usage < ($DU$+5))
| table File_System,Total,Used,Available,Disk_Usage
| rename Total as "Total in GB" Used as "Used in GB" Available as "Available in GB" Disk_Usage as "Disk_Usage in %"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You're getting a single value because that's what you asked for with "Disk_Usage=$DU$".  To get a range of values, use >= and <.

.... | where (Disk_Usage>=$DU$ AND Disk_Usage < ($DU$+5))
| table File_System,Total,Used,Available,Disk_Usage
| rename Total as "Total in GB" Used as "Used in GB" Available as "Available in GB" Disk_Usage as "Disk_Usage in %"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...