Splunk Search

How to get the exact row from a results table to use for other panel searches in the same dashboard?

belladonna
New Member

Hello!

I want to make an error monitoring dashboard. I want to have a table with (operation| okOperations/allOperations) and 4 timechart panels with top-error operations, that work dynamically.

For the first table I have a search

index=prt result=*
| eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation 
| eval ratio=1-okOp/totalOp|stats max(ratio) as ratio by operation | sort 3 -ratio

It returns result table

<table>
    <tr>
        <td>operation</td>
        <td>result</td>
    </tr>
    <tr>
        <td>check</td>
        <td>1</td>
    </tr>
    <tr>
        <td>search</td>
        <td>0. 2</td>
    </tr>
    <tr>
        <td>buy</td>
        <td>0.2</td>
    </tr>
</table>

Now I want to use operations names in 3 new searches (for 3 panels) like this:
|rownum = 1 |timechart count(operation) by result

|rownum = 2 |timechart count(operation) by result

|rownum = 3 |timechart count(operation) by result

I don't want to use | streamstats count as rownum, because it works very slowly. How can I make a search for panels?
It will be good to use hidden search and then reuse its results in panels.

0 Karma

sundareshr
Legend

Like this

*For the first row*

 ... | head 1

*For the second row*

... | head 2 | tail | head 1

**** For the third row****

... | tail 1
0 Karma

spunk_enthusias
Path Finder

Is there really no better way than this?

0 Karma

belladonna
New Member
 index=prt result=*
 | eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation 
 | eval ratio=1-okOp/totalOp|stats max(ratio) as ratio by operation | sort 3 -ratio| head 1|timechart count(operation) by result 

doesn't return anything

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...