Dashboards & Visualizations

Post-process search drops subsearch and timerange from query

johnansett
Communicator

I'm having a lot of trouble with one of my Post-process searches. I have the following dashboard built.

<dashboard>
         <search id="base">
          <query>
            sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
            | dedup ip
            | fields ip
          </query>
          <earliest>-4h@m</earliest>
          <latest>-5m</latest>
          <sampleRatio>1</sampleRatio>
        </search>
  <label>ABC-1</label>
  <description>ABC-1 Errors</description>
  <row>
    <panel>
      <title>ABC-1 Errors Last 4 Hours - Unresolved</title>
      <single>
        <search base="base">
          <query>
            stats dc(ip)
           </query>
        </search>
      </single>
    </panel>
    <panel>
      <title>Total ABC-1 Errors Last 4 Hours</title>
      <single>
        <search>
          <query>
            sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)
          </query>
        </search>
      </single>
    </panel>
  </row>
    <row>
    <panel>
      <title>List of Unresolved ABC-1 IP Addresses</title>
      <table>
        <search base="base">
                    <query>
                      | table ip
                     </query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

The first inline search has no issues and the bottom post process search works (| table ip - gives me the table of IP addresses). However the stats dc search (stats dc(ip) - ABC-1 Errors Last 4 Hours - Unresolved) gives me incorrect results. When I open in search, the search is over all time and simply:

sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)

It seems to have dropped the sub-search and time range. What am I doing wrong here?

Thanks!

0 Karma
1 Solution

johnansett
Communicator

My fault - was looking at the wrong panels, I cleaned this up and it works fine now.

View solution in original post

0 Karma

johnansett
Communicator

My fault - was looking at the wrong panels, I cleaned this up and it works fine now.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
you have used base="base" in only 2 panels.

  1. ABC-1 Errors Last 4 Hours - Unresolved.
  2. List of Unresolved ABC-1 IP Addresses.

Not used in "Total ABC-1 Errors Last 4 Hours" panel.

Is it proper as per your dashboard logic?

0 Karma

somesoni2
Revered Legend

Try this for your base search

sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
 | stats count by ip

ABC-1 Errors Last 4 Hours - Unresolved search as

| stats count as Unresolved_IP
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...