how to make a dashboard and query in splunk

Question

I am new in splunk and only have a basic knowledge in querying. I need to create a dashboard that will count the total number of policy for each server. I have an example data, it shows the different host and policy.

Example data:

I want to generate a dashboard like this:

My code is like this:

eval search if("$Host$"="AAA") | stats count(Policy) as "AAA" by Policy |
eval search if("$Host$"="BBB") | stats count(Policy) as "BBB" by Policy |
eval search if("$Host$"="CCC") | stats count(Policy) as "CCC" by Policy |

score 2 · Answer 1 · answered Mar 01 '19 at 16:16

2

stats is a filtering command so Host values are lost to subsequent eval statements. Try this query, instead:

... | stats count by Host, Policy | addcoltotals

answered Mar 01 '19 at 16:16

RichG

9,063
2
18
29

how to make a dashboard and query in splunk

1 Answers1