Splunk Search

How do I create a table with each row has separate search?

Subbu
Loves-to-Learn

I am beginner and i want to create something like this

Subbu_0-1689870029193.png

my Splunk search1 is 

index=XXX source="/opt/middleware/ibm/"  findsachinattendance |timechart count span=60m | stats max(*) AS *

my Splunk search2 is 

index=XXX source="/opt/middleware/ibm/"  findtendulkarattendance |timechart count span=60m | stats max(*) AS *

 

I found something but i couldnt relate to work 

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-Table-where-each-row-is-the-result-of-...

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While technically you indeed could append several searches and table them together in a way similar to this you linked to, you generally shouldn't.

Especially that you have almost identical searches which differ only by the one initial search term, which means that those searches might be relatively easy to aggregate into one.

So instead of "thinking non-splunky and trying to implement it in Splunk", tell us what problem you're trying to solve and we'll see if there is a "splunky" solution.

 

0 Karma

Subbu
Loves-to-Learn

Thanks for response, our logs are not pretty formatted to write splunk query. 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk is pretty good at extracting information from log event, especially with regular expressions, so if you can show us sanitised versions of your log events and what it is you are try to achieve (as @PickleRick suggested), perhaps we can find a way forward for you.

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...