Splunk Search

I'm able to generate statistics with my search, but why am I unable to save it as dashboard?

le_krish
New Member

I'm able to generate statistics with my search, but why am I unable to save it as dashboard?
how to eliminate this speacal characters in the search.

|inputlookup MSDN_Call_Counts.csv             
|map search="|inputlookup MSDN_Lookup.csv | search RTR_Call="$RTR_Call$"  | eval count=$count$|rename $RTR_HTTP_Resp$ as Response|table RTR_Call,Response,count" maxsearches=1000
|chart sum(count) over RTR_Call by Response|fillnull value=0
0 Karma
1 Solution

dbcase
Motivator

Change $variable name$ to $$variable name$$ for the dashboard

View solution in original post

dbcase
Motivator

Change $variable name$ to $$variable name$$ for the dashboard

le_krish
New Member

thanks it worked... struggling from morning....

0 Karma

dbcase
Motivator

Great! If you can accept an answer to close out the question that would be great!

0 Karma

dbcase
Motivator

Change "$RTR_Call$" to "$$RTR_Call$$"

0 Karma

le_krish
New Member

it is saying no results found and below is my whole query

|inputlookup MSDN_Call_Counts.csv             
|map search="|inputlookup MSDN_Lookup.csv | search RTR_Call="$$RTR_Call$$"  | eval count="$$count$$"|rename "$$RTR_HTTP_Resp$$" as Response|table RTR_Call,Response,count" maxsearches=1000
|chart sum(count) over RTR_Call by Response|fillnull value=0|fields - NULL
|eval Bad_perc=round((Bad/(Bad+Good)*100),2)
|eval Good_perc=round((Good/(Good+Bad)*100),2)

 |join RTR_Call [|inputlookup MSDN_Lookup.csv |table Threshold,ThresholdCount,RTR_Call,API_Call]
 |rex field=RTR_Call "(?\w+.+?)"
 |eval Status= if(Good_perc >= 70 ,"Pass" ,"Fail")
 |eval Total_count=Bad+Good|where Total_count > ThresholdCount
0 Karma

cmerriman
Super Champion

Can you create a new dashboard from the Dashboards view and click 'edit source' and put something like this in there, or change the options for if your using a chart instead of a table?

<dashboard>
  <label>Title</label>
    <row>
    <panel>
      <table>
        <search>
          <query>|inputlookup MSDN_Call_Counts.csv             
 |map search="|inputlookup MSDN_Lookup.csv | search RTR_Call="$RTR_Call$"  | eval count=$count$|rename $RTR_HTTP_Resp$ as Response|table RTR_Call,Response,count" maxsearches=1000
 |chart sum(count) over RTR_Call by Response|fillnull value=0</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

le_krish
New Member

this is , is whole query ,even after editing the source i'm unable see the results on the dashboard, i'm getting something like this " search is wating for the input" ...

|inputlookup MSDN_Call_Counts.csv             
|map search="|inputlookup MSDN_Lookup.csv | search RTR_Call=$RTR_Call$  | eval count=$count$|rename $RTR_HTTP_Resp$ as Response|table RTR_Call,Response,count" maxsearches=1000
|chart sum(count) over RTR_Call by Response|fillnull value=0|fields - NULL
|eval Bad_perc=round((Bad/(Bad+Good)*100),2)
|eval Good_perc=round((Good/(Good+Bad)*100),2)
 |join RTR_Call [|inputlookup MSDN_Lookup.csv |table Threshold,ThresholdCount,RTR_Call,API_Call]
 |rex field=RTR_Call "(?\w+.+?)"
 |eval Status= if(Good_perc >= 70 ,"Pass" ,"Fail")
 |eval Total_count=Bad+Good|where Total_count > ThresholdCount
0 Karma

dbcase
Motivator

Change $variable name$ to $$variable name$$ for the dashboard

0 Karma

inventsekar
Ultra Champion

I remember this issue.. let's try ...
Please take only a part of this query and save it as the dashboard.
Once saved as dashboard, click edit source XML, there you will see the part of the query, add the full query now. Then save it.
In this method, that won't give any errors regarding the special characters.

0 Karma

le_krish
New Member

it is saying "search is waiting for the input" and below is my whole query

|inputlookup MSDN_Call_Counts.csv 
|map search="|inputlookup MSDN_Lookup.csv | search RTR_Call="$$RTR_Call$$" | eval count="$$count$$"|rename "$$RTR_HTTP_Resp$$" as Response|table RTR_Call,Response,count" maxsearches=1000
|chart sum(count) over RTR_Call by Response|fillnull value=0|fields - NULL
|eval Bad_perc=round((Bad/(Bad+Good)*100),2)
|eval Good_perc=round((Good/(Good+Bad)*100),2)

|join RTR_Call [|inputlookup MSDN_Lookup.csv |table Threshold,ThresholdCount,RTR_Call,API_Call]
|rex field=RTR_Call "(?\w+.+?)"
|eval Status= if(Good_perc >= 70 ,"Pass" ,"Fail")
|eval Total_count=Bad+Good|where Total_count > ThresholdCount
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...