Dashboards & Visualizations

How to Show Negative Reporting Using lookup with Search query

aditsss
Motivator

Hi Everyone,

I have one requirement:

I have one Usage Dashboard where I am showing the dashboard Name with their Count.

Below is the search query for it:

index="_internal" EventLogFiles
| eval DashboardName=if(like(uri, "%EventLogFiles%"), "EventLogFiles", "Unknown Dashboards")
| stats count by DashboardName |append[search index="_internal" InformaticaExtract
| eval DashboardName=if(like(uri, "%InformaticaExtract%"), "InformaticaExtract", "Unknown Dashboards")
| stats count by DashboardName]|sort DashboardName

I am getting result like this :

DashboardName                                                      Count

EventLogFiles                                                               500

InformaticaExtract                                                     345

Now My requirement is like this:

I need to create one lookup file(Dashboard.csv) which consists of Dashboard Name like EventLogFiles   and InformaticaExtract      etc. 

I want my lookup to combine with my search query to show the counts.

I want my DashboardName to come from lookup File and my count should come from my search query.

Can someone Guide me on that.

Thanks in advance.

 

Labels (2)
0 Karma

to4kawa
Ultra Champion
0 Karma

aditsss
Motivator

Can someone please guide me on this.

0 Karma

aditsss
Motivator

Can someone please guide me on this.

It will be really helpful.

0 Karma

aditsss
Motivator

Can someone please guide me on this.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...