Dashboards & Visualizations

In Splunk dashboard - I should be able to get logs before the last occurrence of a text msg.

kirti_gupta12
Path Finder

I have a Splunk Dashboard. It has a text field named "Error msg" and a Time-Picker. (Image - "Dashboard items"). 

If the text field "Error msg" is empty, I am able to display all the logs within the given time frame. 

Query : 

 

index=AppIndex cf_app_name=AppName msg!="*Hikari*" taskExecutor- | fields _time msg | sort -_time | 
| table _time msg

 

Now, If I enter a log message in the text field "Error msg", my goal is, for the given time frame,

1. Search all the occurrences of this "Log message".
2. Get the latest occurrence. 
3. In the output table, print the logs right before the last occurrence of the msg. 

In this way, user can trace the error msg and look at the logs (right before the error in the text field) to find what caused the error to happen. 

Any suggestions on how this can be done via a query?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...