Best practice for post-process searches with a timechart base search?

[Graham_Hanningt]

I have a Splunk Enterprise 6.4 dashboard that displays multiple timecharts, all based on the same events in the same time range.

When I first developed this dashboard, each chart had its own self-contained search string. I recently edited the dashboard to use the following base search:

<search id="base_timechart">
  <query>sourcetype=my_log_type $blacklist$ $tran$ $response$ | timechart avg(response) sum(usercpu) avg(dispatch) avg(suspend) avg(syncproc) avg(rmielap) avg(fcwait) avg(jcwait) avg(pcstghwm) avg(tdwait)</query>
</search>

(The tokens are set by user interface controls.)

Here is an example chart search in the updated dashboard:

<search base="base_timechart">
  <query>fields _time avg(response)</query>
</search>

That is, I'm using the fields command to pick a series from the results of the timechartin the base search (for some charts, I pick more than one series).

This works for me, but I thought I'd ask (after searching for existing related questions here and Googling for information elsewhere): is this best practice, or is there a better way?

[somesoni2 · Accepted solution]

I'm using fields OR table command in my similar post-process searches. Can't think of any issues or better way than this. Only other thing that I do is the rename columns in the timechart to something user friendly.

[Graham_Hanningt]

Thanks, @somesoni2!

Yeah, I rename series in charts that display a legend. For single-series charts, I typically don't bother (renaming or displaying a legend).

If you can convert your comment to an answer, I'm happy to accept it. It's very useful for me to get feedback here on what I'm doing as I'm learning Splunk, especially from someone with high karma points (which I'm roughly equating to "experience"). Thanks again.

[ppablo]

Just converted @somesoni2's comment to an answer for you to accept @Graham_Hannington 🙂 cheers!

Patrick

[Graham_Hanningt]

Thanks for converting the comment, Patrick 🙂

[ppablo]

no problem 🙂