Dashboards & Visualizations

Post-process search drops subsearch and timerange from query

johnansett
Communicator

I'm having a lot of trouble with one of my Post-process searches. I have the following dashboard built.

<dashboard>
         <search id="base">
          <query>
            sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
            | dedup ip
            | fields ip
          </query>
          <earliest>-4h@m</earliest>
          <latest>-5m</latest>
          <sampleRatio>1</sampleRatio>
        </search>
  <label>ABC-1</label>
  <description>ABC-1 Errors</description>
  <row>
    <panel>
      <title>ABC-1 Errors Last 4 Hours - Unresolved</title>
      <single>
        <search base="base">
          <query>
            stats dc(ip)
           </query>
        </search>
      </single>
    </panel>
    <panel>
      <title>Total ABC-1 Errors Last 4 Hours</title>
      <single>
        <search>
          <query>
            sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)
          </query>
        </search>
      </single>
    </panel>
  </row>
    <row>
    <panel>
      <title>List of Unresolved ABC-1 IP Addresses</title>
      <table>
        <search base="base">
                    <query>
                      | table ip
                     </query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

The first inline search has no issues and the bottom post process search works (| table ip - gives me the table of IP addresses). However the stats dc search (stats dc(ip) - ABC-1 Errors Last 4 Hours - Unresolved) gives me incorrect results. When I open in search, the search is over all time and simply:

sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)

It seems to have dropped the sub-search and time range. What am I doing wrong here?

Thanks!

0 Karma
1 Solution

johnansett
Communicator

My fault - was looking at the wrong panels, I cleaned this up and it works fine now.

View solution in original post

0 Karma

johnansett
Communicator

My fault - was looking at the wrong panels, I cleaned this up and it works fine now.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
you have used base="base" in only 2 panels.

  1. ABC-1 Errors Last 4 Hours - Unresolved.
  2. List of Unresolved ABC-1 IP Addresses.

Not used in "Total ABC-1 Errors Last 4 Hours" panel.

Is it proper as per your dashboard logic?

0 Karma

somesoni2
Revered Legend

Try this for your base search

sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
 | stats count by ip

ABC-1 Errors Last 4 Hours - Unresolved search as

| stats count as Unresolved_IP
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...