Splunk Search

Combining multiple searches on multiple source files into a single search

sanurd
Path Finder

Hello Experts,

I have a dashboard with a dropdown with the following selection

2022-Mar
2022-Apr
2022-May

Based on the selection I choose a source and run various searches and display the dashboard.
For example, If user input is 2022-Apr, I use the token to use
C:\\test\\data_2022-Apr.csv and run searches and it works fine.

However I also have a requirement where I need to Plot a value from all three sources in a single panel.
For example, Say I have a data point arrived with various calculations called "total utilization" from each sources in the above list.
I need to plot this value for the last 3 months (current + last two months data ) in a single panel.
So if the user selects 2022-May, I need to run searches on each of the above file, get the total utilization and display in a single column chart.
I have used eval command to work out the past months file names and worked out the search command to get the value as well. However, since I am using different sources, I am only able to get them in different search commands, i.e in a different dashboard panel.
So the question is, Is it possible to combine multiple search commands on different sources into one single search and generate a single column graph ? I have looked at subsearch related posts earlier, however they seem to be on different sourcetypes rather than source itself.

Would appreciate any inputs.
Thanks in advance.

Labels (3)
0 Karma

sanurd
Path Finder

Just in case if anyone else runs in to this post. I solved this problem using saved searches that takes dynamic inputs for previous months data and then using eval data =[ savedsearch | return output ] option to get the search results.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...