topic How to get the exact row from a results table to use for other panel searches in the same dashboard? in Splunk Search

How to get the exact row from a results table to use for other panel searches in the same dashboard?

belladonna — Thu, 16 Jun 2016 09:36:56 GMT

Hello!

I want to make an error monitoring dashboard. I want to have a table with (operation| okOperations/allOperations) and 4 timechart panels with top-error operations, that work dynamically.

For the first table I have a search

index=prt result=*
| eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation 
| eval ratio=1-okOp/totalOp|stats max(ratio) as ratio by operation | sort 3 -ratio

It returns result table

<table>
    <tr>
        <td>operation</td>
        <td>result</td>
    </tr>
    <tr>
        <td>check</td>
        <td>1</td>
    </tr>
    <tr>
        <td>search</td>
        <td>0. 2</td>
    </tr>
    <tr>
        <td>buy</td>
        <td>0.2</td>
    </tr>
</table>

I don't want to use | streamstats count as rownum, because it works very slowly. How can I make a search for panels?
It will be good to use hidden search and then reuse its results in panels.

Re: How to get the exact row from a results table to use for other panel searches in the same dashboard?

sundareshr — Thu, 16 Jun 2016 12:57:35 GMT

Like this

*For the first row*

 ... | head 1

*For the second row*

... | head 2 | tail | head 1

**** For the third row****

... | tail 1

Re: How to get the exact row from a results table to use for other panel searches in the same dashboard?

belladonna — Fri, 17 Jun 2016 11:06:52 GMT

 index=prt result=*
 | eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation 
 | eval ratio=1-okOp/totalOp|stats max(ratio) as ratio by operation | sort 3 -ratio| head 1|timechart count(operation) by result

doesn't return anything

Re: How to get the exact row from a results table to use for other panel searches in the same dashboard?

spunk_enthusias — Fri, 20 Jan 2023 12:21:41 GMT

Is there really no better way than this?