topic Re: Two Unrelated Searches -- One Report in Splunk Search

Two Unrelated Searches -- One Report

whod81 — Wed, 10 Oct 2012 15:12:12 GMT

Is it possible to attach two searches to a single report?

SEARCH ONE (daily report by host, time ranged -1d@d to @d)

sourcetype="xxx" xtime=*s | convert auto(xtime) | search xtime>=6 | chart count(eval(xtime>=6)) as 6+, count(eval(xtime>=12)) as 12+, count(eval(xtime>=18)) as 18+ by host

SEARCH TWO (daily report not by host but last 7 days worth of counts, time range -7d@h to now)

sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | timechart span=1d count(eval(dtime>=60)) as 60+, count(eval(dtime>=120)) as 120+, count(eval(dtime>=180)) as 180+

Re: Two Unrelated Searches -- One Report

lguinn2 — Thu, 11 Oct 2012 06:36:58 GMT

Why not build a dashboard with 2 panels? You can schedule the dashboard to be generated and emailed daily...

See Schedule Delivery of Dashboard Printouts via Email

Re: Two Unrelated Searches -- One Report

whod81 — Thu, 11 Oct 2012 15:50:53 GMT

This is a good idea, but unfortunately PDF isn't a format I'm hip to recieving every day.

Re: Two Unrelated Searches -- One Report

sowings — Thu, 11 Oct 2012 16:54:00 GMT

The dashboard can still contain two panels; it doesn't have to be emailed. Consider the main landing page of the search app--there are several different panels. The searches that drive a given panel don't have to be related. Each of your above searches could easily be given its own panel, viewable on demand (vs. scheduled).