Splunk Search

Saved Searches with different time output

appmandan
Path Finder

I have a panel that's running 9 inline searches. Panel one displays a line chart of results for the last 24 hours, Panel 2 displays results for the last 7 days, and panel 3 displays the results for the last 30 days. I could reduce the 9 inline searches down to three using a safe search, but I'm having trouble figuring out how to specify the differnt time ranges in my different charts. Is there a way I can display results for one saved search in differnt panels that display a different time range?

Thanks

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of

  • running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
  • putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see

Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.

There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.

View solution in original post

lguinn2
Legend

You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of

  • running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
  • putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see

Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.

There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.

appmandan
Path Finder

THANKS!!!!

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...