Splunk Search

Is there any way to have the below query without map command?

Abilan1
Path Finder

Hi ,

With the below query, am facing issue while creating dashboard, as it is having a map command.

index=Test host=XXX "ABNUM" | map search="search source=$source$ | streamstats current=f last(_raw) AS next_line | search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"

is there any other way to make the same without map command.

techusky
Explorer

I'm not sure if this is the problem you are facing, but you can use the "map" command in dashboards just fine... however, since dashboards use the $field$ syntax to represent any input values to the dashboard (and map commands use the same syntax to reference the value of a given input field), you need to add a second $ around any variables in your map command. So for instance, when you define your search inside your dashboard, it would be something like this:

index=Test host=XXX "ABNUM" | map search="search source=$$source$$ | streamstats current=f last(_raw) AS next_line
| search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"
0 Karma

Abilan1
Path Finder

It is not working on search, not sure I didn't try for dashboard. am looking for a query which works in both dashboard as well as search.

0 Karma

sideview
SplunkTrust
SplunkTrust

Can you add a row of two to illustrate what your raw data looks like? I think that would help us answer your question better.

Also, this is a bit off the cuff, but I have a suspicion that what you need revolves around using the somewhat advanced "by" argument to streamstats.

index=Test host=XXX "ABNUM" | streamstats current=f last(_raw) AS next_line by source | .... 
0 Karma

Abilan1
Path Finder

Hi,

I would like to capture the seconds which is highlighted on the below logs and only for the table ABNUM (which is on next event).

Note: There are other tables like EmpID,USER,etc..will also be a part of the source file. But I need only for ABNUM table's query time. Please let me know if you need any additional information.

Log File:

Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)

Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )

0 Karma

javiergn
SplunkTrust
SplunkTrust

You could use a subsearch. Something like:

index=foo [
    search index=Test host=XXX "ABNUM" | dedup source | table source
] 
| streamstats current=f last(_raw) AS next_line 
| search " took " next_line="ABNUM"
| dedup _raw next_line 
| rex "query took (?\d+).*((?\d+) seconds)"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...