Splunk Search

How to use multiple saved searches for a single table

AKG1_old1
Builder

Hi,
We are using a table in our dashboard and its output is based on multiple saved search.
How can I run multiple saved search in parallel and combined its result in a single table?

I have created below search which works fine but I am not be able to use in my dashboard.

| makeresults 
| eval ALERT="KPI_MXTIMING_MEM_LIVEBOOK_SESSION_FUNCTION" 
| append 
    [ makeresults 
    | eval ALERT="KPI_MXTIMING_LIVEBOOK_SESSION_CC_1MIN_FUNCTION"] 
| table ALERT 
| map  search="| savedsearch "$ALERT$" host_token=MX_Archival41 earliest_time_token=-10d"

When I add this search in the dashboard it says waiting for input. Reason is $ALERT$ in search which takes results from the first part of the search but on dashboard, even the first part won't run if there is any unassigned token present in search.

If I run this search directly it's working but not on the dashboard.

alt text

I am using mapping instead of append as there could be 10 saved searches and it will take longer to execute.
So I'm looking for a solution to run these saved search in parallel and produce results in a single table.

0 Karma

somesoni2
Revered Legend

Try this

| makeresults 
 | eval ALERT="KPI_MXTIMING_MEM_LIVEBOOK_SESSION_FUNCTION" 
 | append 
     [ makeresults 
     | eval ALERT="KPI_MXTIMING_LIVEBOOK_SESSION_CC_1MIN_FUNCTION"] 
 | table ALERT 
 | map  search="| savedsearch "$$ALERT$$" host_token=MX_Archival41 earliest_time_token=-10d"

AKG1_old1
Builder

Brilliant !! @somesoni2 : Thank you. please update this as answer.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...