Reporting

How can I create a report which uses an Accelerated Search and uses Intentions

anthonycopus
Path Finder

Hi,

At the moment I'm trying to get a report to run using an accelerated search, but I need to add in both a post process and an intention which set the time bucket. Currently I have as seen below:

    <module name="TimeRangePicker">
        <param name="searchWhenChanged">True</param>
        <param name="label">Time Range:</param>
        <param name="selected">Last 7 days</param>
        <module name="StaticSelect">
            <param name="settingToCreate">span_setting</param>
            <param name="label">Bin Span:</param>
            <param name="searchWhenChanged">True</param>
            <param name="selected">Daily</param>
            <param name="staticFieldsToDisplay">
                <list>
                    <param name="value">1h</param>
                    <param name="label">Hourly</param>
                </list>
                <list>
                    <param name="value">1d</param>
                    <param name="label">Daily</param>
                    </list>
            </param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">span_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="span_search">
                           <param>name="fillOnEmpty">True</param>
                           <param>name="value">$target$</param>
                        </param>
                    </param>
                </param>
                <module autoRun="True" group="User Log" layoutPanel="panel_row1_col1" name="HiddenSavedSearch">
                    <param name="savedSearch">logs_accelerated</param>
                    <param name="groupLabel">Log</param>
                    <module name="HiddenPostProcess">
                        <param name="search">search | timechart sum(count) AS Count</param>

Ideally, I would want the HiddenPostProcess to have:

| timechart $span_search$ sum(Count) AS Count

However, I'm aware that intentions can't be added to HiddenPostProcesses. Altering the savedsearch to a normal search which uses the saved search followed by the intention isn't allowing use of the acceleration (as I can see by the count in the report acceleration summary).

Is there a way around this so I can use an accelerated search to create a timechart and allow the time bucket to be selected without using Sideview Utils?

sideview
SplunkTrust
SplunkTrust

You have an autoRun="True" way down in your XML instead of up at the top of the tree. It may be causing no harm but I doubt it. Move that all the way up to the topmost module before doing anything else. I doubt it's causing this problem but it may well be causing confusion of some kind.

From your XML it seems clear that you want the intention's "span" argument to apply to the timechart in HiddenPostProcess? That cannot be done - Splunk's HiddenPostProcess module doesn't work either with intentions or with raw $foo$ tokens.

Fortunately if you did switch to Sideview Utils, this view would get a bit simpler.

<module name="TimeRangePicker" autoRun="True">
    <param name="searchWhenChanged">True</param>
    <param name="label">Time Range:</param>
    <param name="selected">Last 7 days</param>

    <module name="Pulldown">
        <param name="name">span</param>
        <param name="label">Bin Span:</param>
        <param name="staticOptions">
            <list>
                <param name="value">1h</param>
                <param name="label">Hourly</param>
            </list>
            <list>
                <param name="value">1d</param>
                <param name="label">Daily</param>
                </list>
        </param>

        <module name="SavedSearch" group="User Log" layoutPanel="panel_row1_col1">
            <param name="savedSearch">logs_accelerated</param>
            <module name="PostProcess">
                <param name="search">| timechart $span$sum(count) AS Count</param>

That said, if that saved search is saved with acceleration, and if your span_setting intention as written is not matching some $foo$ token in the base search (it would be very strange and nonsensical to have a $foo$ token in a saved search btw), then I'm not sure why the acceleration isn't taking affect - other problems with postprocess/intentions aside.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...