Re: Multiple Base searches in a dasboard

leandromatperei · ‎08-28-2020

I have some dashboards in Splunk and I would like to use basesearch so that they load a little faster, I don't have much experience with this use. I have the example of xml using the data provided by Splunk itself, could you help me in the best way how to use basesearch in these panels?

<form theme="dark">
  <label>2808 Leandro Matos</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="checkbox" token="checkhost" searchWhenChanged="true">
      <label>Selecione o Host</label>
      <valuePrefix>host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=web
| table host
| dedup host</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
      <choice value="*">ALL</choice>
    </input>
    <input type="multiselect" token="multiselect" searchWhenChanged="true">
      <label>Selecione os endereços de IP</label>
      <prefix>clientip IN (</prefix>
      <suffix>)</suffix>
      <delimiter>, </delimiter>
      <fieldForLabel>clientip</fieldForLabel>
      <fieldForValue>clientip</fieldForValue>
      <search>
        <query>index=web
| table clientip
 | dedup clientip</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="link" token="listcategoria">
      <label>Selecione a Categoria:</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>categoryId</fieldForLabel>
      <fieldForValue>categoryId</fieldForValue>
      <search>
        <query>index=web
| table categoryId
| dedup categoryId
| sort categoryId</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=web $multiselect$ | stats count by clientip</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=web categoryId=$listcategoria$ | stats count by categoryId</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=web $checkhost$ | stats count by host</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Mapa</title>
      <input type="time" token="time" searchWhenChanged="true">
        <label>Selecione o range de tempo</label>
        <default>
          <earliest>0</earliest>
          <latest></latest>
        </default>
      </input>
      <html/>
      <html>Selecione a posição no mapa para detalhamento na tabela</html>
      <map>
        <search>
          <query>index=web | iplocation clientip | geostats count by Country</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="mapping.type">marker</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="map.click.south">$click.bounds.south$</set>
          <set token="map.click.east">$click.bounds.east$</set>
          <set token="map.click.north">$click.bounds.north$</set>
          <set token="map.click.west">$click.bounds.west$</set>
        </drilldown>
      </map>
      <html/>
    </panel>
    <panel>
      <title>Lista de IP's</title>
      <table>
        <search>
          <query>index=web
| iplocation clientip prefix=client
| table client*
| search clientlat &gt;= $map.click.south$
         clientlat &lt;= $map.click.north$
         clientlon &gt;= $map.click.west$
         clientlon &lt;= $map.click.east$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Hosts</title>
      <input type="time" token="time2" searchWhenChanged="true">
        <label>Selecione o intervalo de tempo</label>
        <default>
          <earliest>0</earliest>
          <latest></latest>
        </default>
      </input>
      <html/>
      <chart>
        <search>
          <query>index=web | stats count by host</query>
          <earliest>$time2.earliest$</earliest>
          <latest>$time2.latest$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"count": "#00FFFF"}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="refresh.display">progressbar</option>
      </chart>
      <html/>
    </panel>
  </row>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
       <style>
           .dashboard-body {
               background: #f28500 !important; 
            } 
          .dashboard-panel{ 
               border-radius: 20px;
            }           
          h2{ 
               color: #f28500; 
            }
       </style>
      </html>
    </panel>
  </row>
</form>

ITWhisperer · ‎08-29-2020

Your base query should be a superset of the queries in your dashboards

<form theme="dark">
  <label>2808 Leandro Matos</label>
  <search id="web">
    <query>index=web | stats count by host, clientip, categoryid
    </query>
    <earliest>-7d@d</earliest>
    <latest>@d</latest>
  </search>

Your panel searches can then be based on this search further refining it to your needs

    <panel>
      <chart>
        <search base="web">
          <query>search categoryId=$listcategoria$ | stats sum(count) as count by categoryId</query>
        </search>

isoutamo · ‎08-29-2020

Hi

as I already posted to your previous question about this base search issue, you will have problem with limits.conf on non-transforming base search if your base search returns more than 500 000 events. And if you have web site with lot of visitors or you need to analysi it for longer period this is obvious result.

https://community.splunk.com/t5/Splunk-Search/Base-search-query-for-different-dashboard/m-p/516844#M...

Btw have you looked apps from splunkbase to getthe same results, what you are now looking?

It think that this one https://splunkbase.splunk.com/app/2699/ could be quite close to your needs based on those queries which you have posted on these two questions.

r. Ismo

Multiple Base searches in a dasboard

timechart

Can’t make it to .conf25? Join us online!

Community Content Calendar, September edition

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you a member of the Splunk Community?