Dashboards & Visualizations

How to get all events data for further processing?

fjp2485
Engager

Hi,

In our application we have to
1. visualize all events' data retrieved by the given search
2. And we have to use all events' data in further processing.
However in the <progress> and <done> events only the first event's data are accessible (in the $result.field$ tokens). I'm wondering why don't these tokens contain values of the current event. Could you tell me if is there a way to get all events' data for further processing?

Thanks in advance,
fjp2485

0 Karma

fjp2485
Engager

Hi Vatsal,

Thanks for your quick answer. That shows an interesting approach: to link a search to another one.
But I don't see that our task can be solved simply with such linked searches.
Let me explain our goal:

There are three search results on our dashboard.
1. The first one takes its input from XML files in subfolders of a given folder and shows the result in a table in increasing time order. (This search contains installation results overview.)
Then the user clicks on a column in this table. The drill down operation takes the subfolder of the selected item (installation duration and overall result) and initiates two other searches in that subfolder. In addition the clicked item shall be shown in a brighter color.
2-3. These searches run in the above mentioned subfolder and take their input from different XML files and show their contents (result of installation steps and result of system integration tests).

So far so good. See attached image

Now we have to make the drill down operation on the last item automatic: when the uppermost chart is displayed then the detailed results of the last item shall be shown without any user interaction in the lower two charts.

Now you can see why did I write that if progress events contained each result items fields then this task could be - relatively - easily accomplished.

With best regards,
fjp2485

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @fjp2485,

Check if basesearch works in your case!! Result of basesearch can be further processed in child search in the dashboard.

<form>
  <search id="Base_Search">
       <query>index=_internal | head 1000</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
   </search>
   <row>
       <panel>
            <table>
                 <search base="Base_Search>
                       <query></query>
                  </search>
            </table>
        </panel>
    </row>
    <row>
       <panel>
            <chart>
                 <search base="Base_Search>
                       <query>| timechart count</query>
                  </search>
            </chart>
        </panel>
     </row>
</form>

Here in this example, it first panel (table) shows the output of basesearch and second panel (chart) further process it and shows timechart.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...