topic Re: Splunk nested query in Dashboards & Visualizations

Splunk nested query

smorla — Tue, 12 Mar 2024 16:00:13 GMT

index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(REQUESTED)*") |stats latest(_time) as start_time by cwmessage.transId |join cwmessage.transId [search index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(COMPLETED)*") |stats latest(_time) as cdx_time by cwmessage.transId ] [search index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(UPDATeD)*") |stats latest(_time) as upd_time by cwmessage.transId ] |join cwmessage.transId |eval cdx=cdx_time-start_time, upd=upd_time-cdx_time |table cwmessage.transId, cdx,upd

From above query I'm using index query in multiple times, i want to use it as base search and call that in all nested searches for the dashboard. Please help me.
Thanks

Re: Splunk nested query

ITWhisperer — Tue, 12 Mar 2024 17:08:27 GMT

Try something like this

index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(REQUESTED)*") OR (cwmessage.message = "*Notification(COMPLETED)*") OR (cwmessage.message = "*Notification(UPDATED)*") | stats latest(eval(if(match('cwmessage.message',".*Notification\(REQUESTED\).*"),_time,null()))) as start_time latest(eval(if(match('cwmessage.message',".*Notification\(COMPLETED\).*"),_time,null()))) as cdx_time latest(eval(if(match('cwmessage.message',".*Notification\(UPDATED\).*"),_time,null()))) as upd_time by cwmessage.transId | eval cdx=cdx_time-start_time, upd=upd_time-cdx_time | table cwmessage.transId, cdx,upd

Re: Splunk nested query

richgalloway — Tue, 12 Mar 2024 17:47:57 GMT

Are you trying to reduce the number of joins in the query (a good goal) or use this query in multiple dashboard panels (or maybe both)?

Re: Splunk nested query

smorla — Wed, 13 Mar 2024 02:33:33 GMT

Okay will try. Thanks.