Splunk Search

Is it possible to use event sampling in the new dashboard studio?

letienne
Path Finder

Hello,

Is it possible at all to use event sampling (1:100 or 1:1000) in the new dashboard studio?

It works fine using classic dashboarding, but I'm unable to find a way to use it in the new json format, and it's not documented here: Data source options and properties - Splunk Documentation

I would have expected something like this to work:

 

 

"options": {
	"query": "mysearch",
	"sampleRatio": 100
},

 

 

 Thanks !

0 Karma

chekolyn
Engager

I also was looking for this on the new Dashboard Studio.

The only thing that helped was appending this to the search:

... | noop sample_ratio=10

 From: https://community.splunk.com/t5/Splunk-Search/Can-sampling-for-subsearches-be-used-to-parameterize-m...

Noop Doc: https://docs.splunk.com/Documentation/Splunk/9.0.5/SearchReference/Noop

TrangCIC81
Communicator

In case if it is OK with Splunk Enterprise latest version, you can refer to this below link.

https://docs.splunk.com/Documentation/Splunk/9.0.4/Search/Retrieveasamplesetofevents

Event sampling might not be available in all versions of Splunk, and the feature may have limitations depending on your specific use case.

0 Karma

MAD1
Engager

I think the question is with regard to Dashboard Studio.  From the "Search" dialog you can sample data and have it create a Classic Dashboard, where the sampleRatio parameter is populated.  However if you choose to create a dashboard from your search using Dashboard Studio, then the sampleRatio parameter is not carried over (v9.0.4).   Either it is a missing feature or missing documentation.  I find it interesting that even new Splunk documentation has samples using the old dashboard technology and not Dashboard Studio. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...