https://community.splunk.com/t5/Splunk-Search/simplifying-a-field-extraction-error-dashboard/m-p/482879#M135238 <P>Possible to use the results of the same search in multiple panels on the same dashboard, and with different visualizations for them? (By the "same search" I mean: run it once, present results in several places via different means.)</P> <P>Reason: make it faster, use less resources.</P> <P>Example:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="data quality dashboard"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8762i84B5329D9B571BFC/image-size/large?v=v2&amp;px=999" role="button" title="data quality dashboard" alt="data quality dashboard" /></span></P> <P>All four panels of the above dashboard use basically the same search that checks if a field <CODE>message</CODE> was extracted, and reports the stats highlighting the number of events where that field is not present.</P> <P>Notes:<BR /> - Field <CODE>message</CODE> <EM>should</EM> be present in <STRONG>all</STRONG> events; if it's not - it's a field extraction error.<BR /> - The error is not necessarily the result of a bad field extraction regex - it could also be the result of a malformed event, event breaking too soon, etc.<BR /> - The top right panel is all that is needed - yet the other panels do help - I'd like to keep them there - although not at the expense of running multiple redundant searches.</P> <P>The search:</P> <PRE><CODE>sourcetype="some_sourcetype" | eval "Field Extraction Error(s)" = if(isnull(message),"present","not present") | stats sparkline count by "Field Extraction Error(s)" </CODE></PRE> <P>Possible?</P> <P>Thanks!</P> Fri, 24 Apr 2020 19:45:52 GMT mitag 2020-04-24T19:45:52Z https://community.splunk.com/t5/Splunk-Search/simplifying-a-field-extraction-error-dashboard/m-p/482879#M135238 <P>Possible to use the results of the same search in multiple panels on the same dashboard, and with different visualizations for them? (By the "same search" I mean: run it once, present results in several places via different means.)</P> <P>Reason: make it faster, use less resources.</P> <P>Example:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="data quality dashboard"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8762i84B5329D9B571BFC/image-size/large?v=v2&amp;px=999" role="button" title="data quality dashboard" alt="data quality dashboard" /></span></P> <P>All four panels of the above dashboard use basically the same search that checks if a field <CODE>message</CODE> was extracted, and reports the stats highlighting the number of events where that field is not present.</P> <P>Notes:<BR /> - Field <CODE>message</CODE> <EM>should</EM> be present in <STRONG>all</STRONG> events; if it's not - it's a field extraction error.<BR /> - The error is not necessarily the result of a bad field extraction regex - it could also be the result of a malformed event, event breaking too soon, etc.<BR /> - The top right panel is all that is needed - yet the other panels do help - I'd like to keep them there - although not at the expense of running multiple redundant searches.</P> <P>The search:</P> <PRE><CODE>sourcetype="some_sourcetype" | eval "Field Extraction Error(s)" = if(isnull(message),"present","not present") | stats sparkline count by "Field Extraction Error(s)" </CODE></PRE> <P>Possible?</P> <P>Thanks!</P> Fri, 24 Apr 2020 19:45:52 GMT https://community.splunk.com/t5/Splunk-Search/simplifying-a-field-extraction-error-dashboard/m-p/482879#M135238 mitag 2020-04-24T19:45:52Z https://community.splunk.com/t5/Splunk-Search/simplifying-a-field-extraction-error-dashboard/m-p/482880#M135239 <P>Yes, it's possible. It's also common and recommended. Splunk calls it "post-processing" and you can read about it at <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2">https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2</A></P> Fri, 24 Apr 2020 19:55:53 GMT https://community.splunk.com/t5/Splunk-Search/simplifying-a-field-extraction-error-dashboard/m-p/482880#M135239 richgalloway 2020-04-24T19:55:53Z