All Apps and Add-ons

Need Help with Search Command and Dashboard

luvukrishna
Engager

I am trying to create a dashboard that would return count on search, Currently I am getting "service" as input from user through drop-down and I am running search .
Example: when user selects "A" below search is run and result is displayed in panel as count
service="A" | stats count
similarly for other drop downs
service="B" | stats count
service="C" | stats count

I am new to Splunk , Is there a way I can run add all option in drop-down and get result for all fiends in drop-down in tabular format in panel

Required result: On selecting all option
Service | Count
A 10
B 20
C 30

0 Karma

jpass
Contributor

Something else to consider is using postprocess search. This way your base search doesn't have to run every time someone chooses an option in the dropdown.

See: http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches

Here's the basic idea:

  • dashboard loads and runs a base search that generates the full list of stats:

    | STATS count BY Service

  • your input dropdown could access the values of 'Service' to dynamically populate your input options

  • you'll need to still add a static value to cover the * (all) option

  • your post process search, which dictates the values displayed on your dashboard, is simply:

    | SEARCH Service = $dropdown_value$

0 Karma

jpass
Contributor

do your search as:

| STATS count BY Service | SEARCH Service = $dropdown_value$

So your drop down has an option for "ALL" who's value is: *

When the user selects A:

| STATS count BY Service | SEARCH Service = "A"

When user selects ALL:
| STATS count BY serivce | SEARCH service = *

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...