Hi,
I have a lot of data that I want to process on many graphs. So I created a report which will collect all HTTP logs that I need. But now, I have a problem with appending the search query to those search results, like showing graphs, lists or badges.
So to sum up, I would like to append the search query to the report's results.
Thanks
well post processing searches are efficient use for splunk dashboards but in your case you have a lot of raw data and your post search is depending on earliest and latest time which you cant use in base search.
so I would recommend you to remove base search and use full search for every report like this:
eventtype=nix-all-logs site="awstats" earliest=-60m latest=now | timechart span=5m count by site
you need to use same query for every report just that change earliest and latest time. I think this would be more efficient.
let me know if this helps!
Can you elaborate your question with sample input event details and output you want?
I have generated report with this query:
eventtype=nix-all-logs (site="awstats") => That can take too long so that why it is report. So in my dashboard which have to results of that report. For example to show statistics like "| fields _time site | timechart count by site", but the problem is that I don't know how to append that search query to the result which I got from report.
can you try this :
eventtype=nix-all-logs site="awstats" | timechart count by site
This is my base search.
https://pastebin.com/EhAwYfTy
The earliest is the problem. It should be on the another side of the pipe in generated search, which is: eventtype=nix-all-logs (site="awstats") | earliest=@h-1h latest=now | fields _time site
| timechart count by site
then make this as your base search
eventtype=nix-all-logs (site="awstats") earliest=-60m latest=now | fields _time site
True, I have graphs for the last hour, last day, last week and last month. And the report is generated that save last month of data.
so you mean to say that your earliest time and latest is varying depending on the report and all the reports are in one dashboard and using the same base search?
Yes, that is right.