Dashboards & Visualizations

How to find unique events in a dashboard with a base search and several post-process searches?

polssn
New Member

I have a dashboard which uses a base search that finds all events that we are interested in, then use post-process searches to classify this data into several different categories ("known concerns").

In the end, I want to display all events that are not picked up by any of these post-process searches, but I can't seem to find any primitive that would do this.

Basically, the logic I need is: BASE XOR (CATEGORY1 OR CATEGORY2 OR ...)

Ideally without having to duplicate the post-process searches again, since the results are already found.

0 Karma

mayurr98
Super Champion

So in short you need to filter out post process searches using NOT and OR operator.
Your query would be BASE NOT (CATEGORY1 OR CATEGORY2 OR ...)

Try this run anywhere XML

<dashboard>
  <label>Post Process Searches</label>
  <search id="Base_Search">
       <query>index=_internal | head 1000</query>
   </search>
  <row>

    <panel><title>ERROR</title>
      <event>
        <search base="Base_Search">
           <query>| search "ERROR"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>INFO</title>
      <event>
        <search base="Base_Search">
           <query>| search "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>WARNING</title>
      <event>
        <search base="Base_Search">
           <query>| search "WARNING"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
   <row>
    <panel><title>NOT "ERROR" NOT "WARNING" NOT "INFO"</title>
      <event>
        <search base="Base_Search">
           <query>| search NOT "ERROR" NOT "WARNING" NOT "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</dashboard>

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...