topic Re: how to display pattern tab result in report in dashboard? in Dashboards & Visualizations

how to display pattern tab result in report in dashboard?

cyberportnoc — Tue, 30 Aug 2016 06:47:45 GMT

how to display pattern tab result in report in dashboard?
i click save as report and find no option about showing pattern tab result

is there any command equivalent to show the same result as pattern tab

Re: how to display pattern tab result in report in dashboard?

s2_splunk — Tue, 29 Sep 2020 10:47:18 GMT

There is no direct way to display the patterns tab the way it is formatted in the Search and Reporting app in a dashboard.
But... the Patterns tab is produced by running a cluster command under the covers. You can check the _audit index after selecting the patterns tab and you will see something like this (I used a search on the _internal index when selecting patterns):
index=_internal | cluster t=0.3 labelonly=true labelfield=_patterns match=termset | findkeywords labelfield=_patterns dedup=true
You can start here and format the output to satisfy your display needs.

Re: how to display pattern tab result in report in dashboard?

cyberportnoc — Wed, 31 Aug 2016 09:38:06 GMT

result are different from pattern tab after append this command

https://drive.google.com/file/d/0Bxs_ao6uuBDUR1g1djdIZHVhejQ/view?usp=sharing
https://drive.google.com/file/d/0Bxs_ao6uuBDURUhHdDNlUEh3RUU/view?usp=sharing

Re: how to display pattern tab result in report in dashboard?

cyberportnoc — Thu, 01 Sep 2016 01:45:47 GMT

find found no _audit index in pattern tab or search events tab, where is it?

Re: how to display pattern tab result in report in dashboard?

cyberportnoc — Tue, 29 Sep 2020 10:48:02 GMT

i append index=_internal or index=_audit

https://drive.google.com/file/d/0Bxs_ao6uuBDUd2xMcXdyY3JkR1E/view?usp=sharing
https://drive.google.com/file/d/0Bxs_ao6uuBDUOWdnYXl3LXhpSzA/view?usp=sharing

but no result

autojoin='1' buckets=300 ttl=600 max_count=500000 maxtime=8640000 enable_lookups='1'

Re: how to display pattern tab result in report in dashboard?

cyberportnoc — Tue, 29 Sep 2020 10:49:04 GMT

is there any updated in your answer?

after tried to append index=_audit or index=_internal , still can not create the same result as pattern tab

Re: how to display pattern tab result in report in dashboard?

s2_splunk — Fri, 02 Sep 2016 16:31:21 GMT

I was using the internal index as an example to show you what is being executed under the covers by the patterns tab. You would obviously have to use the index that contains your data for which you want to identify the patterns. Which index contains the data for your sourcetype=access*? That's the one you need to search. If it's searched by default, just remove index=_internal

Your results from 2 days ago were different, because you looked at the patterns tab for a search over your data, but added index=_internal to the search that used the cluster command. The timeframes were slightly different as well.

Re: how to display pattern tab result in report in dashboard?

edoardo_vicendo — Thu, 07 Mar 2019 19:16:12 GMT

Just adding one note because I have seen this discussion as I was looking for the same answer.

Going in Settings >> Monitoring Console >> Search >> Activity >> Search Usage Statistics: Instance and then selecting the option "Only Ad Hoc Searches" = NO, you can find the search triggered by Splunk when you click on "Pattern" tab:

| loadjob 1233886270.2 events=true require_finished=false | cluster t=0.8 labelonly=true labelfield=_patterns match=termset | findkeywords labelfield=_patterns dedup=true

this is exactly what is done in the background (where 1233886270.2 is the search job id)

Then if you want to recreate the same result, approximately you have to attach this to your search

| cluster t=0.8 labelonly=t showcount=t labelfield=_patterns match=termset
| findkeywords labelfield=_patterns dedup=true
| search confidence>0
| fields - search
| sort -percentMatched

Just wondering/checking how exactly it is sorting the results, and how is calculating the number of events matched