Splunk Search

Is it possible to use event sampling in the new dashboard studio?

letienne
Path Finder

Hello,

Is it possible at all to use event sampling (1:100 or 1:1000) in the new dashboard studio?

It works fine using classic dashboarding, but I'm unable to find a way to use it in the new json format, and it's not documented here: Data source options and properties - Splunk Documentation

I would have expected something like this to work:

 

 

"options": {
	"query": "mysearch",
	"sampleRatio": 100
},

 

 

 Thanks !

Labels (1)
0 Karma

chekolyn
Engager

I also was looking for this on the new Dashboard Studio.

The only thing that helped was appending this to the search:

... | noop sample_ratio=10

 From: https://community.splunk.com/t5/Splunk-Search/Can-sampling-for-subsearches-be-used-to-parameterize-m...

Noop Doc: https://docs.splunk.com/Documentation/Splunk/9.0.5/SearchReference/Noop

TrangCIC81
Communicator

In case if it is OK with Splunk Enterprise latest version, you can refer to this below link.

https://docs.splunk.com/Documentation/Splunk/9.0.4/Search/Retrieveasamplesetofevents

Event sampling might not be available in all versions of Splunk, and the feature may have limitations depending on your specific use case.

0 Karma

MAD1
Engager

I think the question is with regard to Dashboard Studio.  From the "Search" dialog you can sample data and have it create a Classic Dashboard, where the sampleRatio parameter is populated.  However if you choose to create a dashboard from your search using Dashboard Studio, then the sampleRatio parameter is not carried over (v9.0.4).   Either it is a missing feature or missing documentation.  I find it interesting that even new Splunk documentation has samples using the old dashboard technology and not Dashboard Studio. 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...