Splunk Search

Combining multiple searches on multiple source files into a single search

sanurd
Path Finder

Hello Experts,

I have a dashboard with a dropdown with the following selection

2022-Mar
2022-Apr
2022-May

Based on the selection I choose a source and run various searches and display the dashboard.
For example, If user input is 2022-Apr, I use the token to use
C:\\test\\data_2022-Apr.csv and run searches and it works fine.

However I also have a requirement where I need to Plot a value from all three sources in a single panel.
For example, Say I have a data point arrived with various calculations called "total utilization" from each sources in the above list.
I need to plot this value for the last 3 months (current + last two months data ) in a single panel.
So if the user selects 2022-May, I need to run searches on each of the above file, get the total utilization and display in a single column chart.
I have used eval command to work out the past months file names and worked out the search command to get the value as well. However, since I am using different sources, I am only able to get them in different search commands, i.e in a different dashboard panel.
So the question is, Is it possible to combine multiple search commands on different sources into one single search and generate a single column graph ? I have looked at subsearch related posts earlier, however they seem to be on different sourcetypes rather than source itself.

Would appreciate any inputs.
Thanks in advance.

Labels (3)
0 Karma

sanurd
Path Finder

Just in case if anyone else runs in to this post. I solved this problem using saved searches that takes dynamic inputs for previous months data and then using eval data =[ savedsearch | return output ] option to get the search results.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...