Reporting

Schedule report with variable field

splunkuzleuven
Loves-to-Learn Lots

First and foremost: maybe what I'm looking for isn't possible or I'm going down the wrong road, in which case, please enlighten me.

So say we have search:

index=my_index my_field1=* | timechart my_field2

I can add this search to a dashboard and make it so, that with a dropdown list I can select what my_field1 will be. So I can generate a result overall, or a specific selection of it.
Now this search takes a while, so I thought I'd schedule it. This works, but the substition is not scheduled. So in other words, if I use the result in the dashboard, my search result remains "my_field1=*", no matter the substition from the dropdown list.

Is there an easy way to schedule all possible outcomes for this search? (they are fixed, so a lookup table for the values is an option)
Or do I need to look at other mechanisms to speed up the search, and if so, which would that be?

Kind regards,
Herman

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi splunkuzleuven,
you should use summary indexes:

  • schedule your search choosing a time period and a span adeguate to your needs;
  • add to you search the row | collect index=my_summary ;
  • then use the new summary index for your searches as a database table.

the search to schedule (e.g. every hour) will be something like this:

index=my_index my_field1=* earliest=-h@h latest=@h
| timechart count BY my_field2 span=1h
| collect index=my_summary

then you can run something like this:

index=my_summary earliest=7d latest=now
| timechart sum(count) AS Total BY $my_token$

In this way you can use in your dashboard the results of your report (your scheduled search) that's very quick and you can pass tokens to it.

Analyze the collect command to understand if there are any additional options useful for you.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunkuzleuven,
you should use summary indexes:

  • schedule your search choosing a time period and a span adeguate to your needs;
  • add to you search the row | collect index=my_summary ;
  • then use the new summary index for your searches as a database table.

the search to schedule (e.g. every hour) will be something like this:

index=my_index my_field1=* earliest=-h@h latest=@h
| timechart count BY my_field2 span=1h
| collect index=my_summary

then you can run something like this:

index=my_summary earliest=7d latest=now
| timechart sum(count) AS Total BY $my_token$

In this way you can use in your dashboard the results of your report (your scheduled search) that's very quick and you can pass tokens to it.

Analyze the collect command to understand if there are any additional options useful for you.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...