Splunk Search

Combining multiple searches on multiple source files into a single search

sanurd
Path Finder

Hello Experts,

I have a dashboard with a dropdown with the following selection

2022-Mar
2022-Apr
2022-May

Based on the selection I choose a source and run various searches and display the dashboard.
For example, If user input is 2022-Apr, I use the token to use
C:\\test\\data_2022-Apr.csv and run searches and it works fine.

However I also have a requirement where I need to Plot a value from all three sources in a single panel.
For example, Say I have a data point arrived with various calculations called "total utilization" from each sources in the above list.
I need to plot this value for the last 3 months (current + last two months data ) in a single panel.
So if the user selects 2022-May, I need to run searches on each of the above file, get the total utilization and display in a single column chart.
I have used eval command to work out the past months file names and worked out the search command to get the value as well. However, since I am using different sources, I am only able to get them in different search commands, i.e in a different dashboard panel.
So the question is, Is it possible to combine multiple search commands on different sources into one single search and generate a single column graph ? I have looked at subsearch related posts earlier, however they seem to be on different sourcetypes rather than source itself.

Would appreciate any inputs.
Thanks in advance.

Labels (3)
0 Karma

sanurd
Path Finder

Just in case if anyone else runs in to this post. I solved this problem using saved searches that takes dynamic inputs for previous months data and then using eval data =[ savedsearch | return output ] option to get the search results.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...