Need a little assistance with reporting. I am currently indexing multiple anti-virus reports into SPlunk daily and are receiving these reports from various Regions globally. (i.e. North America, South America, Europe).
However, I would build 3 seperate reports based on the unique regions.
Report 1 - North America
Report 2 - South America
Report 3 - Europe
Would an EVAL (IF) or CASE statement work here. Here is a subset of the fields that are being indexed: Region Country Location Sub Location
You could write a macro that does the reporting and then invoke it along with your selection criteria. For example,
imagine that your macro is named
av_summary and contains something like this
sourcetype=av* plus other search terms | cool transformations here | stats count by virus sublocation location country | other cool reporting or charting
You could invoke the macro like this in the search bar
You could even save a search for each region. But since the underlying macro would be shared, you would have only one place to update the actual report.
It's easy to create a macro, just go to Manager>>Advanced Search>>Macros