Splunk Cloud

Search Reference

Download manual as PDF

Download topic as PDF

gauge

Description

Use the gauge command to transform your search results into a format that can be used with the gauge charts. All gauge charts visualize a single aggregated metric, such as a count or a sum.

The output of the gauge command is a single numerical value stored in a field called x. You can specify a range to display in the gauge, or use the default range 0 - 100.

For more information about using the gauge command with the gauge chart types, see the Chart section in the Using gauges in the Data Visualization Manual.

Syntax

gauge <value> [<range_val1> <range_val2> ...]

Required arguments

value
Syntax: field_name | <num>
Description: A numeric field or literal number to use as the current value of the gauge. If you specify a numeric field, the gauge command uses the first value in that field as the value for the gauge.

Optional arguments

range values
Syntax: <range_val1> <range_val2> ...
Description: A space-separated list of two or more numeric fields or numbers to use as the overall numeric range displayed in the gauge. Each range value can be a numeric field name or a literal number. If you specify a field name, the first value in that field is used as the range value. The total range of the gauge is from the first range_val to the last range_val. See Usage.
Default range: 0 to 100.

Usage

You can create gauge charts without using the gauge command, as long as your search results in a single value. The advantage of using the gauge command is that you can specify a set of range values instead of using the default range values 0 - 100.

Specifying ranges

If you specify range values, you must specify at least two values. The gauge begins at the first value and ends at the last value that you specify.

If you specify more than two range_val arguments, the intermediate range values are used to split the total range into sub-ranges. These sub-ranges are visually distinct using by using different colors for each subrange.

Ranges are output into a series of fields called y1, y2, and so on.

If you do not specify range values, the range defaults to a low value of 0 and a high value of 100.

If a single range value is specified, it is ignored.

Gauge colors

With a gauge chart, a single numerical value is mapped against a set of colors. These colors can have particular business meaning or business logic. As the value changes over time, the gauge marker changes position within this range.

The color ranges in the gauge chart are based on the range values that you specify with the gauge command. When you specify range values, you define the overall numerical range represented by the gauge and you can define the size of the colored bands within that range. If you want to use the color bands, add four range values to the search string. These range values indicate the beginning and end of the range. These range values also indicate the relative sizes of the color bands within this range.

Examples

1. Create a gauge with multiple ranges

Count the number of events and display the count on a gauge with 4 ranges, where the ranges are 0-750, 750-1000, 1000-1250, and 1250-1500.

Start by generating the results table using this search. Run the search using the Last 15 minutes time range.

index=_internal | stats count as myCount | gauge myCount 750 1000 1250 1500

The results appear on the Statistics tab and look something like this:

x y1 y2 y3 y4
3321 750 1000 1250 1500

Click on the Visualizations tab. There are three types of gauges that you can choose from: radial, filler, and marker. The following image shows a radial gauge.

This image shows a radial gauge. The value, 3321, is greater than the highest number, 1500, in the range values. The gauge needle is at the 1500 range marker.

For more information about using the gauge command with the gauge chart type, see the Gauges section in Dashboard and Visualizations.

See also

eval, stats

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the gauge command.

PREVIOUS
from
  NEXT
gentimes

This documentation applies to the following versions of Splunk Cloud: 6.6.3, 7.0.3, 7.0.0, 7.0.2


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters