Splunk Search

Question on transformation commands

prettysunshinez
Explorer

Hi All,

I need your helping in writing post process & base searches..
My dashboard requires a chart command in the first panel..
So having the post process search as below in first panel,I'm unable to write the base searches in the following panels which requires stats,table and sometimes raw data in them..

1st panel :
Search id = "base"

Query - index = source= | regex field1 | regex field2 | chart count over field1 by field2

2nd panel:
I wanted to perform stats count by field 1

3rd panel :
I want to display the raw events for the select value of field1 from the above panel

4th panel :
I want to display stats count by field x

Please suggest me how can i proceed with it.
Will i be able to use streamstats or eventstats in the first panel or is there any other suggestions for this.

Thanks in advance.

0 Karma

prettysunshinez
Explorer

Any suggestions pls

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make panel 3 your base search using index = source= | regex field1 | regex field2. The other panels reference the base search and add their respective transformations.

---
If this reply helps you, Karma would be appreciated.
0 Karma

prettysunshinez
Explorer

@richgalloway I would not be able to do that because panel 3 query carries a token of field1 value from Panel 2(cell drilldown)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Create your base search before the first panel (not in a row). Be aware that this type of base search has limitations. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2.

<search id="myBaseSearch">
  <query>index= source= | regex field1 | regex field2</query>
</search>
<row>...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...