topic Display all the results of two searches. in Splunk Search

Display all the results of two searches.

email2vamsi — Thu, 21 Oct 2021 11:05:28 GMT

Hi Experts,

I am running two searches by combining them with appendcols.
But the final result is the common fields of both the searches.

I want the entire search result of both the main and subsearch.
I am using stats as well.

Please advise.

Thank you.

Re: Display all the results of two searches.

gcusello — Thu, 21 Oct 2021 11:07:17 GMT

Hi @email2vamsi,

could you share your searches?

Ciao.

Giuseppe

Re: Display all the results of two searches.

email2vamsi — Thu, 21 Oct 2021 11:25:29 GMT

Hi @gcusello,

Re: Display all the results of two searches.

gcusello — Thu, 21 Oct 2021 11:49:44 GMT

Hi @email2vamsi,

it's also possible to optimize this search without using append command (not the appendcols command): remeber that there's the limit of 50,000 results in subsearches.

But anyway, please try something like this:

beware to one thing: I sow a space in the fields you used in spath commands, is this correct or not?

If you have a space in a field you have to use double quotes.

Then there's an error in the search command "search _url=US OR ASIA", you should use "search _url=US OR _url=ASIA"

Ciao.

Giuseppe

Re: Display all the results of two searches.

email2vamsi — Fri, 22 Oct 2021 09:24:28 GMT

Hello @gcusello

Your query worked for me after changing it to append.

I have one more problem. For drill-down, I can see the following token in the URL.
selected_value=8.8.0%0D%0A*

Here %0D%0A means a space.
I just want to pass 8.8.0*, with out a space.
The rtrim in source dashboard is unable to trim the space at the end of 8.8.0.

Please suggest.

Thank you

Re: Display all the results of two searches.

PickleRick — Fri, 22 Oct 2021 10:13:39 GMT

append is a different command than append cols - works in a different way. So it's up to you to decide which mode of operation is proper for your needs.

And no, %OD%OA does not mean space. It's most probably \r\n

Re: Display all the results of two searches.

gcusello — Fri, 22 Oct 2021 11:04:41 GMT

Hi @email2vamsi,

this is another question, but anyway, can you share the drilldown row in dashboard source and the complete url?

Probably there's something in the drilldown row.

Ciao.

Giuseppe

Re: Display all the results of two searches.

email2vamsi — Fri, 22 Oct 2021 11:36:09 GMT

@gcusello

In the target dashboard query comes like this, with * in the new line.
| search "_version"=10.6.1
*

If i do not use *, no rows is getting displayed.
If i move the * next to 10.6.1 (10.6.1*) , then the rows related to 10.6.1 are getting displayed, including 10.6.1,
10.6.12-105.x86_64,10.6.12-120.x86_64,10.6.13-111,10.6.13-111.x86_64

Re: Display all the results of two searches.

gcusello — Fri, 22 Oct 2021 11:45:13 GMT

Hi @email2vamsi,

at first sight, I hint to insert "*" in the secondary dashboard and pass the token as is.

But, could you share the row of drilldown in the code?

Ciao.

Giuseppe

Re: Display all the results of two searches.

email2vamsi — Fri, 22 Oct 2021 12:01:27 GMT

Hi @gcusello

Version sum(Count) 1 30 2 8.8.0 3 3 10.2.2-1370.x86_64 2 4 10.5.1-1582.x86_64 1 5 10.5.5-106 28 6 10.5.5-106.x86_64 17 7 10.6.1 18 8 10.6.12-105.x86_64 19 9 10.6.12-120.x86_64 756 10 10.6.13-111 5 11 10.6.13-111.x86_64 1

Re: Display all the results of two searches.

gcusello — Fri, 22 Oct 2021 12:08:53 GMT

Hi @email2vamsi,

sorry for the misunderstanding: id' like to see the code of the drilldown section:

open the source of your dashboard

share the drilldown sect6ion of the panel you're analyzing, you can recognize this part because is vetween the <drilldown> tags and similar to the following:

<drilldown> <link target="_blank">/app/my_app/my_secondary_dashboard?earliest=$Time.earliest$&latest=$Time.latest$&my_token=$click.row$</link> </drilldown>

Ciao.

Giuseppe

Re: Display all the results of two searches.

email2vamsi — Fri, 22 Oct 2021 12:16:41 GMT

Hi @gcusello

<drilldown> <link target="_blank">/app/app_name/server_list?selected_value=$click.value$&location_tok2=$location_tok2$&Cust_id=$Cust_id$</link> </drilldown>

Thank you.

Re: Display all the results of two searches.

gcusello — Fri, 22 Oct 2021 12:30:22 GMT

Hi @email2vamsi,

using this link you shouldn't have the "%0D%0A*".

As I said, if you need the "*" for the searches, put it in the secondary dashboard.

Ciao.

Giuseppe

Re: Display all the results of two searches.

email2vamsi — Fri, 22 Oct 2021 12:43:29 GMT

Hi @gcusello

I have moved the * to secondary dashboard.

The token in the URL of the secondary dashboard is like this :
?selected_value=10.6.1%0D%0A

In the secondary dashboard query comes like this, with * in the new line.
| search "_version"="10.6.1
*"

If i do not use *, no rows are getting displayed.
I have to move the * next to 10.6.1 (| search "_version"="10.6.1*") , then the rows related to 10.6.1 are getting displayed, including 10.6.1,
10.6.12-105.x86_64,10.6.12-120.x86_64,10.6.13-111,10.6.13-111.x86_64

The carriage return in secondary dashboard query is causing the query to fail.
I could not figure out from where the carriage return is coming from.

Thank you.

Re: Display all the results of two searches.

gcusello — Fri, 22 Oct 2021 12:52:53 GMT

Hi @email2vamsi,

extract the relevant part of your field using a regex in the main dashboard:

| rex field=selected_value "^(?<selected_value>\d+\.\d+\.\d+)

In this way, you're sure that the field "selected_value" contains only the first three numbers of the IP.

If there's the possibility that the field could contain three or four numbers of the IP you could try this:

| rex field=selected_value "^(?<selected_value>(\d+\.\d+\.\d+)(\d+\.\d+\.\d+\.\d+))

Ciao.

Giuseppe