Splunk Search

How do I create a table with each row has separate search?

Subbu
Loves-to-Learn

I am beginner and i want to create something like this

Subbu_0-1689870029193.png

my Splunk search1 is 

index=XXX source="/opt/middleware/ibm/"  findsachinattendance |timechart count span=60m | stats max(*) AS *

my Splunk search2 is 

index=XXX source="/opt/middleware/ibm/"  findtendulkarattendance |timechart count span=60m | stats max(*) AS *

 

I found something but i couldnt relate to work 

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-Table-where-each-row-is-the-result-of-...

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While technically you indeed could append several searches and table them together in a way similar to this you linked to, you generally shouldn't.

Especially that you have almost identical searches which differ only by the one initial search term, which means that those searches might be relatively easy to aggregate into one.

So instead of "thinking non-splunky and trying to implement it in Splunk", tell us what problem you're trying to solve and we'll see if there is a "splunky" solution.

 

0 Karma

Subbu
Loves-to-Learn

Thanks for response, our logs are not pretty formatted to write splunk query. 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk is pretty good at extracting information from log event, especially with regular expressions, so if you can show us sanitised versions of your log events and what it is you are try to achieve (as @PickleRick suggested), perhaps we can find a way forward for you.

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...