topic Re: Help on Spl query - dashboard Studio in Splunk Search

Help on Spl query - dashboard Studio

jaibalaraman — Fri, 12 May 2023 04:35:35 GMT

How do i edit the below append command into my real time environment

The below source are obtain from Splunk Dasboard Studio

| append
[makeresults count=50
| eval app="CDN"
| eval type="User"
]

| chart count by app, type
| eval sort_field=case(app=="Login",1,app=="Search",2,app=="Cart",3,app=="Pricing",4,app=="Checkout",5,app=="Order Management",6,app=="Gifting",7,app=="Chat",8)
| sort sort_field
| table app, User, System, Idle

My current splunk

index=sample x_host_header=www.sample.com

| eval Device = if(match(useragent,"SM-"),"Android", if(match(useragent,"Windows"),"Windows",if(match(useragent,"Mac"),"Mac",if(match(useragent,"CPH"),"Android",if(match(useragent,"Nokia"),"Android",if(match(cs_user_agent,"Pixel"),"Android",if(match(useragent,"TB-"),"Android",if(match(useragent,"VFD"),"Android",if(match(useragent,"HP%20Pro%20Slate"),"Android",if(match(cs_user_agent,"VOG-L09"),"Android",if(match(useragent,"YAL-L21"),"Android",if(match(useragent,"ATU-L22"),"Android",if(match(useragent,"MAR-LX1A"),"Android",if(match(useragent,"RNE-L22"),"Android",if(match(useragent,"INE-LX2"),"Android",if(match(useragent,"AMN-LX2"),"Android",if(match(useragent,"LYO-LO2"),"Android",if(match(useragent,"DRA-LX9"),"Android",if(match(useragent,"LYA-L29"),"Android",if(match(useragent,"ANE-LX2J"),"Android",if(match(useragent,"STK-L22"),"Android",if(match(useragent,"EML-AL00"),"Android",if(match(useragent,"BLA-L29"),"Android",if(match(useragent,"X11"),"Linux",if(match(useragent,"LDN-LX2"),"Android",if(match(useragent,"TB3-"),"Android",if(match(useragent,"5033T"),"Android",if(match(useragent,"5028D"),"Android",if(match(useragent,"5002X"),"Android",if(match(useragent,"COR-"),"Android",if(match(useragent,"MI%20MAX"),"Android",if(match(useragent,"WAS-LX2"),"Android",if(match(useragent,"vivo"),"Android",if(match(useragent,"EML-L29"),"Android",if(match(useragent ent,"Moto"),"Android",if(match(useragent,"MMB"),"Android", OTHER"))))))))))))))))))))))))))

Re: Help on Spl query - dashboard Studio

ITWhisperer — Fri, 12 May 2023 09:23:43 GMT

What is it that you are trying to achieve?

By the way, you could convert the series of nested if functions to a case function.

Re: Help on Spl query - dashboard Studio

jaibalaraman — Fri, 12 May 2023 11:20:44 GMT

Yes , i have created eval spl query to find out the list mobile device ( Android / Mac / Windows/ Bot / Linux/ duckgo )

Please find below eval command which is working 100% fine , spl command are shared in the my previous chat

index=sample x_host_header=www.sample.com

What i am trying to achieve

I creating Dashboard studio for our application , where i am trying to reverse engineer from already created predefined dashboard studio

The output which i am expecting is to see the list of user who are using Android / Mac / Windows / Linux / Duckduck go

I am not sure about how to edit the below append function which will give me the output

| append
[makeresults count=50
| eval app="CDN"
| eval type="User"
]

Thanks

Re: Help on Spl query - dashboard Studio

ITWhisperer — Fri, 12 May 2023 11:30:10 GMT

Edit the data source or create a new one based on your search and update the panel to use the new / updated data source

Re: Help on Spl query - dashboard Studio

jaibalaraman — Fri, 12 May 2023 11:48:26 GMT

Sorry, i am trying to achieve the same output which i have used with eval apply the same concept for the dashboard studio. Not sure how do i edit t

Re: Help on Spl query - dashboard Studio

ITWhisperer — Fri, 12 May 2023 12:09:05 GMT

Open the dashboard and click on the edit option

Then click on the edit Data Overview button

Click on the pencil for the search you want to update

Or create a new search

Paste your search into the Search with SPL box