Create a horseshoe meter query

Write a search that returns results in the correct format to generate a horseshoe meter.

Query components

Use the stats command to aggregate the metric that you are tracking.

Search results data format

Make sure that the query returns a single numeric value.

Query example

This query aggregates recent error messages on a Splunk platform instance.

index=_internal source="*splunkd.log" log_level="error" | stats count

The query generates a single numeric error count.