Dynamic Chart from Summary Index

[mbuschle]

I'm looking to create a dynamic chart from a summary index, but I'm not sure how to go about it. Basically, I need to create a report of meetings hosted by a number of business units over 13 months. Obviously, I don't want to run that search every time. There are two challenges. First, the BU's change from time to time. So, I really don't want to hardcode them into the search. Second, the only method I can see to do a timechart max(BU_1), max(BU_2), max(BU_3). I'd like Splunk to just pick this up automatically during the search.

I have added to the summary index the values for each BU per month. Basically the search stores the data in the summary as BU_1=xxxxx BU_2=yyyyy BU_3=zzzzz, etc. Can someone suggest a method to get this data into a chart, without hardcoding the Business Units into the search?

[jtrucks]

You can use wildcards so your search can simply do stuff like:

… | timechart max(BU*)

🙂

EDIT:

If the fields all have different names, there isn't much you can do unless you create a lookup table or somehow unify a naming scheme in your summary index. Perhaps when you put the data into the summary index, prepend BU or some other uniform string to each so you can use the above shortcut. if there is no pattern available in the strings to use PCRE to shortcut like above, then you will have to do them all manually listed out.

[somesoni2]

You can use "| timechart max(*)" which will return max count for all the fields and then can remove unwanted fields by using "|fields -,-"

[mbuschle]

That's a good start and would work great if the BU names were actually that simple. Unfortunately, they all have different names. I guess I could either rename them when I put them in the summary or somehow exclude the fields like info_max_time, info_min_time, linecount, etc. Thoughts?