Dashboards & Visualizations

splunk dashboard

Siddharthnegi
Communicator
| inputlookup E.csv
| search 4Let="ABCD"
| stats count as count3
[search index=xyz category="Ad"  "properties.OnboardingStatus"= Onboarded
| dedup properties.DeviceName
| rename properties.DeviceName as DeviceName
| stats count as count2]


this search is giving error

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Siddharthnegi - Try this search

| inputlookup E.csv
| rename "4Let" as "Let4"
| search Let4="ABCD"
| stats count as count3
[search index=xyz category="Ad"  "properties.OnboardingStatus"= Onboarded
| dedup properties.DeviceName
| rename properties.DeviceName as DeviceName
| stats count as count2]

 

I think the problem that you are facing is field name starting with number, which creates problem in search in some-cases.

 

I hope this helps!!! Kindly upvote if it does!!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Siddharthnegi ,

what's the purpose of your search?

using the search you shared you have a main search that arrives to a stats command and then you added another search without any relation with the first one.

Do you want to append the second to the first one or do you want to filter results from the first using the secon one?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...