Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Saved Searches with different time output
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a panel that's running 9 inline searches. Panel one displays a line chart of results for the last 24 hours, Panel 2 displays results for the last 7 days, and panel 3 displays the results for the last 30 days. I could reduce the 9 inline searches down to three using a safe search, but I'm having trouble figuring out how to specify the differnt time ranges in my different charts. Is there a way I can display results for one saved search in differnt panels that display a different time range?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of
- running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
- putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see
Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.
There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of
- running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
- putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see
Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.
There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
THANKS!!!!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
