Splunk Search
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

Multiple Base searches in a dasboard

leandromatperei
Path Finder
‎08-28-2020 02:52 PM

I have some dashboards in Splunk and I would like to use basesearch so that they load a little faster, I don't have much experience with this use. I have the example of xml using the data provided by Splunk itself, could you help me in the best way how to use basesearch in these panels?

 

<form theme="dark">
  <label>2808 Leandro Matos</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="checkbox" token="checkhost" searchWhenChanged="true">
      <label>Selecione o Host</label>
      <valuePrefix>host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=web
| table host
| dedup host</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
      <choice value="*">ALL</choice>
    </input>
    <input type="multiselect" token="multiselect" searchWhenChanged="true">
      <label>Selecione os endereços de IP</label>
      <prefix>clientip IN (</prefix>
      <suffix>)</suffix>
      <delimiter>, </delimiter>
      <fieldForLabel>clientip</fieldForLabel>
      <fieldForValue>clientip</fieldForValue>
      <search>
        <query>index=web
| table clientip
 | dedup clientip</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="link" token="listcategoria">
      <label>Selecione a Categoria:</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>categoryId</fieldForLabel>
      <fieldForValue>categoryId</fieldForValue>
      <search>
        <query>index=web
| table categoryId
| dedup categoryId
| sort categoryId</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=web $multiselect$ | stats count by clientip</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=web categoryId=$listcategoria$ | stats count by categoryId</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=web $checkhost$ | stats count by host</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Mapa</title>
      <input type="time" token="time" searchWhenChanged="true">
        <label>Selecione o range de tempo</label>
        <default>
          <earliest>0</earliest>
          <latest></latest>
        </default>
      </input>
      <html/>
      <html>Selecione a posição no mapa para detalhamento na tabela</html>
      <map>
        <search>
          <query>index=web | iplocation clientip | geostats count by Country</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="mapping.type">marker</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="map.click.south">$click.bounds.south$</set>
          <set token="map.click.east">$click.bounds.east$</set>
          <set token="map.click.north">$click.bounds.north$</set>
          <set token="map.click.west">$click.bounds.west$</set>
        </drilldown>
      </map>
      <html/>
    </panel>
    <panel>
      <title>Lista de IP's</title>
      <table>
        <search>
          <query>index=web
| iplocation clientip prefix=client
| table client*
| search clientlat &gt;= $map.click.south$
         clientlat &lt;= $map.click.north$
         clientlon &gt;= $map.click.west$
         clientlon &lt;= $map.click.east$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Hosts</title>
      <input type="time" token="time2" searchWhenChanged="true">
        <label>Selecione o intervalo de tempo</label>
        <default>
          <earliest>0</earliest>
          <latest></latest>
        </default>
      </input>
      <html/>
      <chart>
        <search>
          <query>index=web | stats count by host</query>
          <earliest>$time2.earliest$</earliest>
          <latest>$time2.latest$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"count": "#00FFFF"}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="refresh.display">progressbar</option>
      </chart>
      <html/>
    </panel>
  </row>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
       <style>
           .dashboard-body {
               background: #f28500 !important; 
            } 
          .dashboard-panel{ 
               border-radius: 20px;
            }           
          h2{ 
               color: #f28500; 
            }
       </style>
      </html>
    </panel>
  </row>
</form>

 

Labels (1)
Labels
Tags (1)
0 Karma
Reply

ITWhisperer
SplunkTrust
SplunkTrust
‎08-29-2020 06:00 AM

Your base query should be a superset of the queries in your dashboards

<form theme="dark">
  <label>2808 Leandro Matos</label>
  <search id="web">
    <query>index=web | stats count by host, clientip, categoryid
    </query>
    <earliest>-7d@d</earliest>
    <latest>@d</latest>
  </search>

Your panel searches can then be based on this search further refining it to your needs

    <panel>
      <chart>
        <search base="web">
          <query>search categoryId=$listcategoria$ | stats sum(count) as count by categoryId</query>
        </search>
0 Karma
Reply

isoutamo
SplunkTrust
SplunkTrust
‎08-29-2020 06:18 AM

Hi

as I already posted to your previous question about this base search issue, you will have problem with limits.conf on non-transforming base search if your base search returns more than 500 000 events. And if you have web site with lot of visitors or you need to analysi it for longer period this is obvious result.

https://community.splunk.com/t5/Splunk-Search/Base-search-query-for-different-dashboard/m-p/516844#M...

Btw have you looked apps from splunkbase to getthe same results, what you are now looking? 

It think that this one https://splunkbase.splunk.com/app/2699/ could be quite close to your needs based on those queries which you have posted on these two questions.

r. Ismo

0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...