topic Re: Splunk dashboard in Dashboards & Visualizations

Splunk dashboard

Als123 — Wed, 28 Apr 2021 14:03:35 GMT

My requirement is like I need to create two panels in my dashboard.

First Panel: When I am choosing last 15 min means I need to get the values from 10 am to 10.15am for today's date(for example).

Second Panel: In second Panel I need to get the data from 10am to 10.15 am for yesterday's date.

It should be like comparison between today's data vs yesterday's data.please help me how to frame query for second Panel?

Re: Splunk dashboard

gcusello — Wed, 28 Apr 2021 14:12:26 GMT

Hi @Als123,

you have to put in your dashboard the Time Picker setted e.g to the last 15 minutes.

In the first panel, you take the value from the Time Picker as it is.

In the second panel you use a search like this (if the Time Picket token is called e.g. "Time"):

your_search [ | makeresults | eval earliest=relative_time($Time.earliest$,"-1d"), latest=relative_time($Time.latest$,"-1d") | fields earliest latest ] | ...

Ciao.

Giuseppe

Re: Splunk dashboard

Als123 — Wed, 28 Apr 2021 14:34:04 GMT

@gcusello ,

I am getting Error in 'eval' command:The expression is malformed.Expected ).

Re: Splunk dashboard

gcusello — Wed, 28 Apr 2021 14:38:33 GMT

Hi @Als123,

the search seems to be correct!

could you share your search?

Ciao.

Giuseppe

Re: Splunk dashboard

Als123 — Wed, 28 Apr 2021 14:41:39 GMT

Hi @gcusello ,

I gave my query like this .

<query>index=xyz |makeresults|eval earliest=relative_time($field1.earliest$,"-1d"),latest=relative_time($field1.latest$,"-1d")|fields earliest latest|timechart span =5m count by specification </query>

My token name is field1

Re: Splunk dashboard

gcusello — Wed, 28 Apr 2021 14:46:33 GMT

Hi @Als123,

it isn't correct: the square parenthesys of the subsearch are missing

<query> index=xyz [ | makeresults | eval earliest=relative_time($field1.earliest$,"-1d"), latest=relative_time($field1.latest$,"-1d") | fields earliest latest ] | timechart span =5m count by specification </query>

In few words, you use a subsearch to calculate the new variables earliest and latest.

One hint: give always a name to the tokens, don't leave $field1$.

Ciao.

Giuseppe

Re: Splunk dashboard

Als123 — Wed, 28 Apr 2021 14:53:55 GMT

Hi @gcusello ,

I have used the query u mentioned. But again I am getting "Erroe in 'eval' command.The expression is malformed.Expected)" error in my panel.

Re: Splunk dashboard

Als123 — Thu, 29 Apr 2021 02:21:14 GMT

Hi Team,

If I am modifying the query like this ("$field1.earliest$"), I am not getting eval error but I am not getting any search results.

<query> index=xyz [ | makeresults | eval earliest=relative_time("$field1.earliest$","-1d"), latest=relative_time("$field1.latest$","-1d") | fields earliest latest ] | timechart span =5m count by specification </query

Please help on this.

Re: Splunk dashboard

gcusello — Thu, 29 Apr 2021 06:18:16 GMT

Hi @Als123,

please try this:

index=xyz [ search index=_internal ! head 1 | addinfo | eval earliest=info_min_time-86400, latest=info_max_time-86400 | fields earliest latest ] | timechart span =5m count by specification

Ciao.

Giuseppe