Splunk Search

How to use report data in search query

s_absinthe
Explorer

Hi everyone,

I need help in figuring out a way to use my report (table data) into calculations in my dashboard panel. I have a report that runs on daily basis and calculates avg response time of servers by environments (app name say ABC, def and xyz). Now I want to use this response time as an input to one of my panel's back end search.

So report data is like below

app name   response time      

1) ABC           0.234 sec

2) def            0.113 sec

3) xyz            0.227 sec

I want to use this response time to build gauge in my dashboard panel. I have added this report in my dashboard panel that gives in a search ref tag but I don't know how to use this further.

 

Labels (3)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

 

Hi @s_absinthe 
you are using report as base search 

<search id="id1" ref="reportname"></search>

please use id of report into panel that you indetended to use 

<row>
<panel>
<single>
<search base="id1"> 
<query> addition processing qurey </query>
</single>
</panel>
</row>

View solution in original post

s_absinthe
Explorer

Thank you for the answer. I was not aware of the "ref" attribute and had only used "id" and then used query with my panels till now. This solution worked for me.

SanjayReddy
SplunkTrust
SplunkTrust

 

Hi @s_absinthe 
you are using report as base search 

<search id="id1" ref="reportname"></search>

please use id of report into panel that you indetended to use 

<row>
<panel>
<single>
<search base="id1"> 
<query> addition processing qurey </query>
</single>
</panel>
</row>

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...