Dashboards & Visualizations

Multi search Dashboard panel

tkerr1357
Path Finder

Hello,

I would like to make a dashboard panel that is a table the shows total successful logins in one row and total failed logins in another row. The base search for both is index=myindex Eventcode=4624(successful) host=myhost1 user=user* | stats count , index=myindex EventCode=4625(failed) host=myhost1 user=user* | stats count. Can anyone help me with how I would display these separate searches in a single dashboard panel?

Labels (2)
0 Karma

niketn
Legend

@tkerr1357 don't introduce subsearch for the query as you can handle straightforward using a query like the following:

Eventcode=4624 ("successful" OR "failed") host=myhost1 user=user* 
| stats count(eval(searchmatch("successful"))) as successful  count(eval(searchmatch("failed"))) as failed

The above search will make single trip to fetch required data from Index and will not be impacted by subsearch limitation. Please try out and confirm! 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

impurush
Contributor

Hi @tkerr1357 

Use the append command to do that.

index=myindex Eventcode=4624(successful) host=myhost1 user=user* | stats count
|append [search index=myindex EventCode=4625(failed) host=myhost1 user=user* | stats count]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...