Reporting

Schedule report with variable field

splunkuzleuven
Loves-to-Learn Lots

First and foremost: maybe what I'm looking for isn't possible or I'm going down the wrong road, in which case, please enlighten me.

So say we have search:

index=my_index my_field1=* | timechart my_field2

I can add this search to a dashboard and make it so, that with a dropdown list I can select what my_field1 will be. So I can generate a result overall, or a specific selection of it.
Now this search takes a while, so I thought I'd schedule it. This works, but the substition is not scheduled. So in other words, if I use the result in the dashboard, my search result remains "my_field1=*", no matter the substition from the dropdown list.

Is there an easy way to schedule all possible outcomes for this search? (they are fixed, so a lookup table for the values is an option)
Or do I need to look at other mechanisms to speed up the search, and if so, which would that be?

Kind regards,
Herman

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi splunkuzleuven,
you should use summary indexes:

  • schedule your search choosing a time period and a span adeguate to your needs;
  • add to you search the row | collect index=my_summary ;
  • then use the new summary index for your searches as a database table.

the search to schedule (e.g. every hour) will be something like this:

index=my_index my_field1=* earliest=-h@h latest=@h
| timechart count BY my_field2 span=1h
| collect index=my_summary

then you can run something like this:

index=my_summary earliest=7d latest=now
| timechart sum(count) AS Total BY $my_token$

In this way you can use in your dashboard the results of your report (your scheduled search) that's very quick and you can pass tokens to it.

Analyze the collect command to understand if there are any additional options useful for you.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunkuzleuven,
you should use summary indexes:

  • schedule your search choosing a time period and a span adeguate to your needs;
  • add to you search the row | collect index=my_summary ;
  • then use the new summary index for your searches as a database table.

the search to schedule (e.g. every hour) will be something like this:

index=my_index my_field1=* earliest=-h@h latest=@h
| timechart count BY my_field2 span=1h
| collect index=my_summary

then you can run something like this:

index=my_summary earliest=7d latest=now
| timechart sum(count) AS Total BY $my_token$

In this way you can use in your dashboard the results of your report (your scheduled search) that's very quick and you can pass tokens to it.

Analyze the collect command to understand if there are any additional options useful for you.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...