Create a report with two different time ranges

New Member

I have a report created which analyzes my data over the past 30 days.

Then I have a dashboard, with three different searches/panels that analyzes specific data over the last 24 hours.

I would like to put the data from this dashboard into the same report. This would be highly convenient to see everything on one page by Id which is a field. If the data is not available for the past 24 hours, but exists over 30 days, that cell should be empty .

More specifically, in the 30 day report I search for all units that have been online in the past 30 days, and then put them in a table.

Id="*" Status="*" earliest=-30d latest=now
| dedup Id
| table _time Id customer Status Number_of_Days_Since_Comms

in the dashboard, my three searches create sparklines or tables.

Id="*" metrics1="0.0"
|chart sparkline(avg(metrics1)) as "Metrics1 over 24 Hours" by Id

Id="*" metrics2="0.0"
|chart sparkline(avg(metrics2)) as "Metrics2 over 24 Hours" by Id

Id="*" (metrics3<="X" OR metrics4<"Y")
|table _time Id metrics3 metrics4 

How can I combine these into a single report?

0 Karma

Esteemed Legend

I have no idea what you really need here. Please edit/comment and add much more detail.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...