topic multiple search output in a single table/list/something in Splunk Search

multiple search output in a single table/list/something

smolcj — Tue, 20 Nov 2012 06:15:56 GMT

hi all,
i am doing an splunk app to reduce the complexity in reading a log file. I am done with the field extractions. Now if i want to display the results of several searches in a single list or table, what shall i do? As because all these informations ae scattered in the file, t will help ohers if it is co-ordinated so,
User:username
Permission:admin
Foldername:foldername1
Servicetype:blabla
is there any way to display result extracted in different searches in a single table or list
Now i am using the search query as

index=main source=sourcename.txt|top user | table user
index=main source=sourcename.txt|top Permission | table Permission

So i am getting a number of tables, how can i make the reult view much more better..
please help
thanks for your time

Re: multiple search output in a single table/list/something

lguinn2 — Tue, 20 Nov 2012 07:34:24 GMT

Why not use a dashboard?

Re: multiple search output in a single table/list/something

smolcj — Tue, 20 Nov 2012 08:15:31 GMT

in dashboard also it is dispalying in different panels, how to do it in a single table.. i tried using table properties like table border='0' so that it looks as a single table. but it is not happening

Re: multiple search output in a single table/list/something

sdaniels — Tue, 20 Nov 2012 13:09:21 GMT

If you want the to have user and permission in the same table just use one of the following:

<your search> | top user by Permission 
<your search> | top user, Permission

You could then add | head 10 or whatever to choose the first 10 etc. based on how many records you want to see in your dashboard view.

Re: multiple search output in a single table/list/something

bmacias84 — Tue, 20 Nov 2012 16:17:11 GMT

I think you want to use appendcols.



index=main source=sourcename.txt|top user | table user| appendcols [

index=main source=sourcename.txt|top Permission | table Permission ]

if your two results are coming from different sources then you might want to use join if you have a common field.



index=main source=sourcename.txt|top user | fields user| join user [

index=test source=sourcename2.txt|top Permission | fields user, Permission ]

Hope this helps or gets you started. Cheers.

Re: multiple search output in a single table/list/something

bmacias84 — Tue, 20 Nov 2012 16:22:58 GMT

If the user and permission fields are in the same event I would go with @sdaniels.

Re: multiple search output in a single table/list/something

smolcj — Wed, 21 Nov 2012 07:26:39 GMT

Thank you bmacias84 ... it worked well