Reporting

How can I create a report which uses an Accelerated Search and uses Intentions

anthonycopus
Path Finder

Hi,

At the moment I'm trying to get a report to run using an accelerated search, but I need to add in both a post process and an intention which set the time bucket. Currently I have as seen below:

    <module name="TimeRangePicker">
        <param name="searchWhenChanged">True</param>
        <param name="label">Time Range:</param>
        <param name="selected">Last 7 days</param>
        <module name="StaticSelect">
            <param name="settingToCreate">span_setting</param>
            <param name="label">Bin Span:</param>
            <param name="searchWhenChanged">True</param>
            <param name="selected">Daily</param>
            <param name="staticFieldsToDisplay">
                <list>
                    <param name="value">1h</param>
                    <param name="label">Hourly</param>
                </list>
                <list>
                    <param name="value">1d</param>
                    <param name="label">Daily</param>
                    </list>
            </param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">span_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="span_search">
                           <param>name="fillOnEmpty">True</param>
                           <param>name="value">$target$</param>
                        </param>
                    </param>
                </param>
                <module autoRun="True" group="User Log" layoutPanel="panel_row1_col1" name="HiddenSavedSearch">
                    <param name="savedSearch">logs_accelerated</param>
                    <param name="groupLabel">Log</param>
                    <module name="HiddenPostProcess">
                        <param name="search">search | timechart sum(count) AS Count</param>

Ideally, I would want the HiddenPostProcess to have:

| timechart $span_search$ sum(Count) AS Count

However, I'm aware that intentions can't be added to HiddenPostProcesses. Altering the savedsearch to a normal search which uses the saved search followed by the intention isn't allowing use of the acceleration (as I can see by the count in the report acceleration summary).

Is there a way around this so I can use an accelerated search to create a timechart and allow the time bucket to be selected without using Sideview Utils?

sideview
SplunkTrust
SplunkTrust

You have an autoRun="True" way down in your XML instead of up at the top of the tree. It may be causing no harm but I doubt it. Move that all the way up to the topmost module before doing anything else. I doubt it's causing this problem but it may well be causing confusion of some kind.

From your XML it seems clear that you want the intention's "span" argument to apply to the timechart in HiddenPostProcess? That cannot be done - Splunk's HiddenPostProcess module doesn't work either with intentions or with raw $foo$ tokens.

Fortunately if you did switch to Sideview Utils, this view would get a bit simpler.

<module name="TimeRangePicker" autoRun="True">
    <param name="searchWhenChanged">True</param>
    <param name="label">Time Range:</param>
    <param name="selected">Last 7 days</param>

    <module name="Pulldown">
        <param name="name">span</param>
        <param name="label">Bin Span:</param>
        <param name="staticOptions">
            <list>
                <param name="value">1h</param>
                <param name="label">Hourly</param>
            </list>
            <list>
                <param name="value">1d</param>
                <param name="label">Daily</param>
                </list>
        </param>

        <module name="SavedSearch" group="User Log" layoutPanel="panel_row1_col1">
            <param name="savedSearch">logs_accelerated</param>
            <module name="PostProcess">
                <param name="search">| timechart $span$sum(count) AS Count</param>

That said, if that saved search is saved with acceleration, and if your span_setting intention as written is not matching some $foo$ token in the base search (it would be very strange and nonsensical to have a $foo$ token in a saved search btw), then I'm not sure why the acceleration isn't taking affect - other problems with postprocess/intentions aside.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...