Splunk Search

Multiple Stats from Base Search

cdstealer
Contributor

Hi,  I'm trying to populate a dashboard using a base search and then pulling multiple stats from those results.

base search: 

 

index=production sourcetype="audit" environ::LV

 

inline search: 

 

| appendpipe 
    [ stats count AS Total by _time] 
| appendpipe 
    [ search ("Error:" OR auditType="error") 
    | stats count AS error by _time] 
| appendpipe 
    [ where auditMicroSeconds>3 
    | stats count AS Over BY _time] 
| appendpipe 
    [ search ("data retrieval" AND "failed") 
    | stats count AS failed BY _time] 
| timechart span=30s count(Total) AS Total count(error) AS Error count(Over) AS Over

 

 But it just doesn't work.  Hope this makes sense.

TIA

Steve

Labels (4)
0 Karma
1 Solution

cdstealer
Contributor

Solving my own question 🙂

Base search is now:

index=production sourcetype="audit" environ::LV | table *

and panel searches are:

| search (field=value OR field=value OR field=value) field=value 
| appendpipe 
    [stats count AS total by _time] 
| appendpipe 
    [search auditType="error" 
    | stats count AS error by _time] 
| appendpipe 
    [where auditMicroSeconds>3 
    | stats count AS over BY _time] 
| appendpipe 
    [search ("data retrieval" AND "failed") 
    | stats count AS failed BY _time] 
| timechart span=30s count(error) AS Error count(over) AS Over3s count(failed) AS Failed count(total) AS Total

 Data is now being presented as expected 🙂

View solution in original post

0 Karma

cdstealer
Contributor

Solving my own question 🙂

Base search is now:

index=production sourcetype="audit" environ::LV | table *

and panel searches are:

| search (field=value OR field=value OR field=value) field=value 
| appendpipe 
    [stats count AS total by _time] 
| appendpipe 
    [search auditType="error" 
    | stats count AS error by _time] 
| appendpipe 
    [where auditMicroSeconds>3 
    | stats count AS over BY _time] 
| appendpipe 
    [search ("data retrieval" AND "failed") 
    | stats count AS failed BY _time] 
| timechart span=30s count(error) AS Error count(over) AS Over3s count(failed) AS Failed count(total) AS Total

 Data is now being presented as expected 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would something like this get you what you want?

index=production sourcetype="audit" environ::LV
| eval error=if(searchmatch ("Error:" OR auditType="error"),1,null())
| eval Over=if(auditMicroSeconds>3,1,null()) 
| eval failed=if(searchmatch ("data retrieval" AND "failed"),1,null())
| timechart span=30s count AS Total count(error) AS Error count(Over) AS Over
0 Karma

cdstealer
Contributor

Hey, Thanks for the suggestion 🙂  Unfortunately it doesn't work 😞  I had to remove the OR X and AND X from the searchmatch and then it just returned the same results as the original.  Appreciated though.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...