Dashboards & Visualizations

Select field with highest value within single event for a dashboard panel

emirhand
New Member

Hi all,

I'm trying to get the hang of Splunk and was stuck somewhere (who wasn't? :). I did search other topics to no avail.

I have events that contain stats from more than one device in a system, such as a bunch of battery voltages. Sample fields from an event could be:
Timestamp, BAT0Voltage, BAT1Voltage, BAT2Voltage, BAT3Voltage

I'm trying to include the BATxVoltage field with the largest value in a dashboard single-value panel. So I would see 566 Volts in the panel for the following sample event:
$Timestamp, 566, 543, 512, 499

But the dashboard would show 593 from this one:
$Timestamp, 566, 543, 593, 496

See, BAT0Voltage was selected in the first event, but BAT2Voltage is selected in the second as it has the largest value in a string of fields.

Thanks in advance to anyone with any ideas (working or not!).

0 Karma
1 Solution

jnudell_2
Builder

Hi @emirhand ,
The answer provided by @richgalloway works and provides a table of maximum values. However, if you're looking for a single value for a particular device to display on a dashboard, you might try this:

| makeresults 
| eval _time=now(), device="UPS001", BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593
| stats latest(BAT*) as BAT* by device
| where device="UPS001"
| table BAT*
| transpose
| stats max("row 1") as MaxVoltage

In the above example, I'm creating a dummy event for a device called UPS001 with 4 battery voltage values. We run a stats to get the most recent value for all devices, then we filter to a specific device (UPS001 in this case). After that we use a transpose command to line all the fields up in a column so that we can run a simple stats command to get the maximum value for the UPS001 device.
alt text

View solution in original post

0 Karma

emirhand
New Member

Thank you both. I think answer by @jnudell_2 fits better for my purposes, and @richgalloway's answer is archived to use for a better fit in the future. 🙂

0 Karma

jnudell_2
Builder

Hi @emirhand ,
The answer provided by @richgalloway works and provides a table of maximum values. However, if you're looking for a single value for a particular device to display on a dashboard, you might try this:

| makeresults 
| eval _time=now(), device="UPS001", BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593
| stats latest(BAT*) as BAT* by device
| where device="UPS001"
| table BAT*
| transpose
| stats max("row 1") as MaxVoltage

In the above example, I'm creating a dummy event for a device called UPS001 with 4 battery voltage values. We run a stats to get the most recent value for all devices, then we filter to a specific device (UPS001 in this case). After that we use a transpose command to line all the fields up in a column so that we can run a simple stats command to get the maximum value for the UPS001 device.
alt text

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This run-anywhere example shows one way to do that.

| makeresults annotate=t | eval BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593 | eval MaxVoltage=0 | foreach BAT*Voltage [eval MaxVoltage=if('<<FIELD>>' > MaxVoltage, '<<FIELD>>', MaxVoltage)] | table MaxVoltage
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...