One-Table Combining Different Search Results in Real-Time

[mlorrette]

My end goal is to show events in one table coming from multiple searches in real time. They all have the same fields. appendcols usually works but not in real-time.

My ideas were:
-Each of the real-time searches will append its results to the same CSV; a different search will display that CSV in real-time.
-Create a dashboard with a panel for each search, somehow dynamically combine them; or at least make them look combined.

There's possible a much simpler answer for this which I'm missing. Any help appreciated!

[DalJeanis]

1) Never use appendcols. There is never a guarantee that the right items are being connected up. Also, if the searches all have the same fields, then appendcols makes no sense whatsoever. append is probably what you meant.

2) What you are doing pretty much guarantees that none of the source searches should be "real time". What splunk calls "real time" should only be used when the SLA for fixing whatever comes up is SECONDS. Instead, schedule a periodic search every 1m or 2m or 3m and you will get better performance and the same speed of viewing the data.

3) Consider a summary index. Each of your searches will scan the raw events and summarize them to the few columns that you need to know, then write them to a summary index. Your dash will read the summary index created by those other searches.