Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Multiple Base searches in a dasboard

leandromatperei
Path Finder
‎08-28-2020 02:52 PM

I have some dashboards in Splunk and I would like to use basesearch so that they load a little faster, I don't have much experience with this use. I have the example of xml using the data provided by Splunk itself, could you help me in the best way how to use basesearch in these panels?

 

<form theme="dark">
  <label>2808 Leandro Matos</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="checkbox" token="checkhost" searchWhenChanged="true">
      <label>Selecione o Host</label>
      <valuePrefix>host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=web
| table host
| dedup host</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
      <choice value="*">ALL</choice>
    </input>
    <input type="multiselect" token="multiselect" searchWhenChanged="true">
      <label>Selecione os endereços de IP</label>
      <prefix>clientip IN (</prefix>
      <suffix>)</suffix>
      <delimiter>, </delimiter>
      <fieldForLabel>clientip</fieldForLabel>
      <fieldForValue>clientip</fieldForValue>
      <search>
        <query>index=web
| table clientip
 | dedup clientip</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="link" token="listcategoria">
      <label>Selecione a Categoria:</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>categoryId</fieldForLabel>
      <fieldForValue>categoryId</fieldForValue>
      <search>
        <query>index=web
| table categoryId
| dedup categoryId
| sort categoryId</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=web $multiselect$ | stats count by clientip</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=web categoryId=$listcategoria$ | stats count by categoryId</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=web $checkhost$ | stats count by host</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Mapa</title>
      <input type="time" token="time" searchWhenChanged="true">
        <label>Selecione o range de tempo</label>
        <default>
          <earliest>0</earliest>
          <latest></latest>
        </default>
      </input>
      <html/>
      <html>Selecione a posição no mapa para detalhamento na tabela</html>
      <map>
        <search>
          <query>index=web | iplocation clientip | geostats count by Country</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="mapping.type">marker</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="map.click.south">$click.bounds.south$</set>
          <set token="map.click.east">$click.bounds.east$</set>
          <set token="map.click.north">$click.bounds.north$</set>
          <set token="map.click.west">$click.bounds.west$</set>
        </drilldown>
      </map>
      <html/>
    </panel>
    <panel>
      <title>Lista de IP's</title>
      <table>
        <search>
          <query>index=web
| iplocation clientip prefix=client
| table client*
| search clientlat &gt;= $map.click.south$
         clientlat &lt;= $map.click.north$
         clientlon &gt;= $map.click.west$
         clientlon &lt;= $map.click.east$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Hosts</title>
      <input type="time" token="time2" searchWhenChanged="true">
        <label>Selecione o intervalo de tempo</label>
        <default>
          <earliest>0</earliest>
          <latest></latest>
        </default>
      </input>
      <html/>
      <chart>
        <search>
          <query>index=web | stats count by host</query>
          <earliest>$time2.earliest$</earliest>
          <latest>$time2.latest$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"count": "#00FFFF"}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="refresh.display">progressbar</option>
      </chart>
      <html/>
    </panel>
  </row>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
       <style>
           .dashboard-body {
               background: #f28500 !important; 
            } 
          .dashboard-panel{ 
               border-radius: 20px;
            }           
          h2{ 
               color: #f28500; 
            }
       </style>
      </html>
    </panel>
  </row>
</form>

 

Labels (1)
Labels
Tags (1)
0 Karma
Reply

ITWhisperer
SplunkTrust
SplunkTrust
‎08-29-2020 06:00 AM

Your base query should be a superset of the queries in your dashboards

<form theme="dark">
  <label>2808 Leandro Matos</label>
  <search id="web">
    <query>index=web | stats count by host, clientip, categoryid
    </query>
    <earliest>-7d@d</earliest>
    <latest>@d</latest>
  </search>

Your panel searches can then be based on this search further refining it to your needs

    <panel>
      <chart>
        <search base="web">
          <query>search categoryId=$listcategoria$ | stats sum(count) as count by categoryId</query>
        </search>
0 Karma
Reply

isoutamo
SplunkTrust
SplunkTrust
‎08-29-2020 06:18 AM

Hi

as I already posted to your previous question about this base search issue, you will have problem with limits.conf on non-transforming base search if your base search returns more than 500 000 events. And if you have web site with lot of visitors or you need to analysi it for longer period this is obvious result.

https://community.splunk.com/t5/Splunk-Search/Base-search-query-for-different-dashboard/m-p/516844#M...

Btw have you looked apps from splunkbase to getthe same results, what you are now looking? 

It think that this one https://splunkbase.splunk.com/app/2699/ could be quite close to your needs based on those queries which you have posted on these two questions.

r. Ismo

0 Karma
Reply
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...
Top