how to make a dashboard and query in splunk

0
votes

I am new in splunk and only have a basic knowledge in querying. I need to create a dashboard that will count the total number of policy for each server. I have an example data, it shows the different host and policy.

Example data:

enter image description here

I want to generate a dashboard like this: enter image description here

My code is like this:

eval search if("$Host$"="AAA") | stats count(Policy) as "AAA" by Policy |
eval search if("$Host$"="BBB") | stats count(Policy) as "BBB" by Policy |
eval search if("$Host$"="CCC") | stats count(Policy) as "CCC" by Policy |
1
splunksplunk-querysplunk-formula

1 Answers

2
votes

stats is a filtering command so Host values are lost to subsequent eval statements. Try this query, instead:

... | stats count by Host, Policy | addcoltotals