Reporting

Dashboard creation with two saved searches

MadhuriVanga
New Member

Hi,

I have two saved searches as follows:

1. abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload|timechart span=1d count by operation

2. abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=returncode //returnCode field=payload|timechart span=1d count by returncode

I want the dashboard count by operation and returncode in a single dashboard. i.e., i need a timechart which has adjacent bars for each operation and within each bar there should be color coded partition based on the returncode.

Kindly help with ideas on how to achieve the same.

Thanks in advance,
Madhuri.

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I believe you want a single search and report, not dashboard. Dashboard is easy (add two different panels with your searches) but a combined graph is inherently more difficult.

Try this:

abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload | xpath outfield=returncode //returnCode field=payload | eval ReportKey = operation.":".returnCode | timechart span=15m count by ReportKey

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I believe you want a single search and report, not dashboard. Dashboard is easy (add two different panels with your searches) but a combined graph is inherently more difficult.

Try this:

abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload | xpath outfield=returncode //returnCode field=payload | eval ReportKey = operation.":".returnCode | timechart span=15m count by ReportKey

View solution in original post

0 Karma

MadhuriVanga
New Member

Hi sir,

Can we have three fields in the ReportKey? like we have 'operation' and 'returncode' can we have one more field included in the ReportKey?

Thanks in advance,
Madhuri.

0 Karma

MadhuriVanga
New Member

Hi,
Thanks a lot sir for the reply! It has helped me in getting the report right!!

Thanks once again.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.