Splunk Search

Saved Searches with different time output

appmandan
Path Finder

I have a panel that's running 9 inline searches. Panel one displays a line chart of results for the last 24 hours, Panel 2 displays results for the last 7 days, and panel 3 displays the results for the last 30 days. I could reduce the 9 inline searches down to three using a safe search, but I'm having trouble figuring out how to specify the differnt time ranges in my different charts. Is there a way I can display results for one saved search in differnt panels that display a different time range?

Thanks

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of

  • running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
  • putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see

Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.

There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.

View solution in original post

lguinn2
Legend

You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of

  • running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
  • putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see

Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.

There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.

appmandan
Path Finder

THANKS!!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...