Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF



The gauge command transforms results into a format suitable for display by the gauge chart types.

Each argument must be either a real number or the name of a numeric field.

If range values are provided there must be two or more. The gauge will begin at the first value provided and end at the final value provided. Intermediate range values will be used to split the total range into sub-ranges. These sub-ranges will be visually distinct.

If no range values are provided, the range will default to a low value of 0 and a high value of 100.

A single range value is meaningless and will be ignored.

The output of the gauge command is a single result, where the value is in a field called x and the ranges are expressed as a series of fields called y1, y2, and so on.

The gauge chart types enable you to see a single numerical value mapped against a range of colors. These colors could have particular business meaning or business logic. As the value changes over time, the gauge marker changes position within this range.

The gauge command enables you to indicate the field. The field value will be tracked by the gauge chart. You can define the overall numerical range represented by the gauge and you can define the size of the colored bands within that range. If you want to use the color bands, you can add four "range values" to the search string. These range values indicate the beginning and end of the range. These range values also indicate the relative sizes of the color bands within this range.

For more information about using the gauge command with the gauge chart type, see the Visualization Reference's subsection about Charts in the Data Visualization Manual.


gauge <value> [<range_val1> <range_val2>...]


Description: A numeric field or literal number to use as the current value of the gauge. A named field will retrieve the value from the first input result.
range_val1 range_val2...
Description: A space-separated list of two or more numeric fields or numbers to use as the displayed range of the gauge. Each parameter can independently be a field name or a literal number. Field names are retrieved from the first input result. The total range of the gauge will be from the first range_val to the last range_val. If there are more than three range_val parameters, the ranges between each set of values will be visually distinguished in the output.
Default range: 0 to 100.


Example 1:

Count the number of events and display the count on a gauge with 4 regions, where the regions are 0-750, 750-1000, 1000-1250,1250-1500.

index=_internal | stats count as myCount | gauge myCount 750 1000 1250 1500

Radial gauge example-1.png

There are three types of gauges that you can choose from: radial, filler, and marker. For more information about using the gauge command with the gauge chart type, see the Gauges section in Dashboard and Visualizations.

See also

eval, stats


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the gauge command.


This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 7.0.0, 7.0.1

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters