Splunk Search

How do I create a table with each row has separate search?

Subbu
Loves-to-Learn

I am beginner and i want to create something like this

Subbu_0-1689870029193.png

my Splunk search1 is 

index=XXX source="/opt/middleware/ibm/"  findsachinattendance |timechart count span=60m | stats max(*) AS *

my Splunk search2 is 

index=XXX source="/opt/middleware/ibm/"  findtendulkarattendance |timechart count span=60m | stats max(*) AS *

 

I found something but i couldnt relate to work 

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-Table-where-each-row-is-the-result-of-...

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While technically you indeed could append several searches and table them together in a way similar to this you linked to, you generally shouldn't.

Especially that you have almost identical searches which differ only by the one initial search term, which means that those searches might be relatively easy to aggregate into one.

So instead of "thinking non-splunky and trying to implement it in Splunk", tell us what problem you're trying to solve and we'll see if there is a "splunky" solution.

 

0 Karma

Subbu
Loves-to-Learn

Thanks for response, our logs are not pretty formatted to write splunk query. 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk is pretty good at extracting information from log event, especially with regular expressions, so if you can show us sanitised versions of your log events and what it is you are try to achieve (as @PickleRick suggested), perhaps we can find a way forward for you.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...