Dashboards & Visualizations

Realtime Combined Search

Splunk Employee
Splunk Employee

What is the best way to combine two different searches with results that can be used in a realtime dashboard? We used appendcols but found out that you cannot use it with realtime.

We have this search right now but how would be transform it to be realtime compatable?

index=os source=cpu host=x38dev10 | multikv fields | timechart span=30s avg(pctUser) as User, avg(pctSystem) as System | appendcols [search index="os" sourcetype="ps" host=x38dev10 | multikv fields pctCPU, COMMAND, USER | search USER=redis OR tomcat | eval process=USER."/".COMMAND | timechart span=30s avg(pctCPU) by process useother="f"]

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

In general, every subsearch finishes before the main search starts. Real-time searches do not finish, hence subsearches cannot be real-time.

I see you have one timechart without a by field, and one timechart with by process, so I'm assuming your end result columns look something like this?

_time User System process1 process2 process3 process4

?

If that's the case you should be able to combine your two searches using OR:

index=o host=x38dev10 (source=cpu OR sourcetype=ps)

Then do field extractions, filtering, eval, whatnot, and give your cpu source a process:

... | eval process=if(source=cpu, "CPU", process)

And throw it all into one timechart by process.

View solution in original post

SplunkTrust
SplunkTrust

In general, every subsearch finishes before the main search starts. Real-time searches do not finish, hence subsearches cannot be real-time.

I see you have one timechart without a by field, and one timechart with by process, so I'm assuming your end result columns look something like this?

_time User System process1 process2 process3 process4

?

If that's the case you should be able to combine your two searches using OR:

index=o host=x38dev10 (source=cpu OR sourcetype=ps)

Then do field extractions, filtering, eval, whatnot, and give your cpu source a process:

... | eval process=if(source=cpu, "CPU", process)

And throw it all into one timechart by process.

View solution in original post