Splunk Search
Highlighted

Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Path Finder

I am using a search cloned from the SoS app. I modified it to sort in the search itself. Though the search does run on my dashboard, it doesn't sort the table using the sort I have at the end of the saved search. Is there a way to specify the sort field in the simple XML?

0 Karma
Highlighted

Re: Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Path Finder

I meant to say I'm using a search cloned FROM the SoS app.

0 Karma
Highlighted

Re: Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Community Manager
Community Manager

Just edited it for ya @dolfantimmy You might want to include the search you're using and how you want the resulting table to display for search gurus to better assist you.

0 Karma
Highlighted

Re: Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Motivator

Hi dolfantimmy,

Please ensure your search doesn't contains any macro's / eventtypes which is created by the SoS.

Most of the SoS application search string contains macro's those are with permission "in app" so probably you need to change the permission to global.

I tried locally its working fine. could you please share the exact query what you are cloned from SoS.

Cheers!
VaSu

Highlighted

Re: Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Path Finder

Slightly modified from sos, here's the search. It run great in the search app. And does display data on my dashboard, but the data is not sorted when shown on the dashboard.


(host="sp3ctxqs01" OR splunkserver=local) action=search (id=* OR searchid=)
| eval searchid=if(isnull(searchid), id, search_id)
| replace '
' with * in searchid
| search search
id!=rt* searchid!=searchparsetmp*
| rex "search='(?.?)', autojoin"
| rex "savedsearchname=\"(?<savedsearchname>.
?)\"]["
| eval search=case(isnotnull(search),search,isnull(search) AND savedsearchname!="","Scheduled search name : ".savedsearchname,isnull(search) AND savedsearchname=="","SID : ".searchid)
| convert num(totalruntime)
| eval user = if(user="n/a", "nobody", user)
| stats min(time) as _time last(user) as user max(totalruntime) as totalruntime last(search) as search by searchid | search searchid=* search!=typeahead* search!="|history" search!=internal* search!=_audit|sort -totalruntime

0 Karma
Highlighted

Re: Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Motivator

Is there a missing space between the minus sign and the field name?? Shouldn´t it be:

... |sort - total_run_time 
0 Karma
Highlighted

Re: Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

Path Finder

Thanks gfuente, I tried that with the same results. The dashboard still displays sorted by event time, not by totalruntime.

0 Karma