Dashboards & Visualizations

Stack Dashboard with 3 values

shahbaz
Engager

Hi,

I have a json event like below, for each "Build Version" which runs on weekly/daily basis it will try to install different  apps ("appName" in json) reports the  app's "Application install status" as "success" or "failure, similarly for "Application launch status"  and "apkAnalysed" status as "Analysed" or "Not Analysed"

Now I want a dashboard that looks like below, for each "Build Version" how many have success ,failure status and "apkAnalysed" status as  "Analysed" in 3 stacks.

is this possible in splunk, i have tried plotting using chart option but it doesn't help 

MicrosoftTeams-image.png

 

{
    "Device Details": {
        "Device": "" ,
        "Build Version": "build_01",
        "Application install status": "success",
        "Application launch status": "Success"
    },
    "apkAnalysed": "Analysed",
    "id": "googleplay",
    "appName": "whatsapp", 
    "appStore": "googleplay",
    "timeStamp": 0,
    "md5sum": "",
    "packageName": "",
    "date": "2021-12-09",
    "downloadPath": "https: xxxx",
    "apkAnalytics": ""
}

 

 

TIA

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| makeresults count=10000
| eval _raw="{
    \"Device Details\": {
        \"Device\": \"\" ,
        \"Build Version\": \"build_".printf("%02d",random()%10)."\",
        \"Application install status\": \"".mvindex(split("success|failure","|"),random()%2)."\",
        \"Application launch status\": \"".mvindex(split("success|failure","|"),random()%2)."\"
    },
    \"apkAnalysed\": \"".mvindex(split("Not |","|"),random()%2)."Analysed\",
    \"id\": \"googleplay\",
    \"appName\": \"whatsapp\", 
    \"appStore\": \"googleplay\",
    \"timeStamp\": 0,
    \"md5sum\": \"\",
    \"packageName\": \"\",
    \"date\": \"2021-12-09\",
    \"downloadPath\": \"https: xxxx\",
    \"apkAnalytics\": \"\"
}"
| spath "Device Details.Build Version" output=BuildVersion
| spath "Device Details.Application install status" output=InstallStatus
| spath "Device Details.Application launch status" output=LaunchStatus
| spath "apkAnalysed"
| stats count(eval(apkAnalysed="Analysed")) as Analysed count(eval(InstallStatus=="success")) as InstallSuccess count(eval(LaunchStatus=="success")) as LaunchSuccess by BuildVersion

ITWhisperer_0-1643287088543.png

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| makeresults count=10000
| eval _raw="{
    \"Device Details\": {
        \"Device\": \"\" ,
        \"Build Version\": \"build_".printf("%02d",random()%10)."\",
        \"Application install status\": \"".mvindex(split("success|failure","|"),random()%2)."\",
        \"Application launch status\": \"".mvindex(split("success|failure","|"),random()%2)."\"
    },
    \"apkAnalysed\": \"".mvindex(split("Not |","|"),random()%2)."Analysed\",
    \"id\": \"googleplay\",
    \"appName\": \"whatsapp\", 
    \"appStore\": \"googleplay\",
    \"timeStamp\": 0,
    \"md5sum\": \"\",
    \"packageName\": \"\",
    \"date\": \"2021-12-09\",
    \"downloadPath\": \"https: xxxx\",
    \"apkAnalytics\": \"\"
}"
| spath "Device Details.Build Version" output=BuildVersion
| spath "Device Details.Application install status" output=InstallStatus
| spath "Device Details.Application launch status" output=LaunchStatus
| spath "apkAnalysed"
| stats count(eval(apkAnalysed="Analysed")) as Analysed count(eval(InstallStatus=="success")) as InstallSuccess count(eval(LaunchStatus=="success")) as LaunchSuccess by BuildVersion

ITWhisperer_0-1643287088543.png

 

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...