Splunk Search

How do I create a table with each row has separate search?

Subbu
Loves-to-Learn

I am beginner and i want to create something like this

Subbu_0-1689870029193.png

my Splunk search1 is 

index=XXX source="/opt/middleware/ibm/"  findsachinattendance |timechart count span=60m | stats max(*) AS *

my Splunk search2 is 

index=XXX source="/opt/middleware/ibm/"  findtendulkarattendance |timechart count span=60m | stats max(*) AS *

 

I found something but i couldnt relate to work 

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-Table-where-each-row-is-the-result-of-...

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While technically you indeed could append several searches and table them together in a way similar to this you linked to, you generally shouldn't.

Especially that you have almost identical searches which differ only by the one initial search term, which means that those searches might be relatively easy to aggregate into one.

So instead of "thinking non-splunky and trying to implement it in Splunk", tell us what problem you're trying to solve and we'll see if there is a "splunky" solution.

 

0 Karma

Subbu
Loves-to-Learn

Thanks for response, our logs are not pretty formatted to write splunk query. 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk is pretty good at extracting information from log event, especially with regular expressions, so if you can show us sanitised versions of your log events and what it is you are try to achieve (as @PickleRick suggested), perhaps we can find a way forward for you.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...