Splunk Search

Using multiple time range on the same index to return different row values

egonstep
Path Finder

Hello all,

I have a report that searches for differents time range like Year to now, Month to now, Last 5 days and last 24 hrs.

The current search is:

search index
| stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total"
| eval "Date" = "Last 24 hrs"
| append [ search "same search index" earliest=-5d@d latest=now()
| stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total"
| eval "Date" = "Last 5 days"]
| append [ search "same search index" earliest=-0mon@mon latest=now()
| stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total"
| eval "Date" = "Month to now"]
| append [ search "same search index" earliest=-0year@year latest=now()
| stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total", earliest(_time) as "Date"
| convert timeformat="%m/%d/%Y" ctime("Date") as "Date"
| eval "Date" = "Year to now - ".'Date']
| table "Date", "Failures", "Passed", "Total"

The final result is a table with 4 rows in it. Containing Last 24 hours, Last 5 days, Month to now and Year to now results.

So the problem that I'm currently facing is sometimes the Year to now results, returns a different Date like 01/27/2020. It's supposed to be the first day of the current year.

The Job Inspect tells me that the append command is consuming a lot of time to be completed.

Is it possible to do the longest search (Year to now) and have multiples stats commands by different time range to get the final result or a way to improve this search?

Thanks for all your help.

BenTreeser
Explorer

@harshpatel could you provide the full dashboard code example? I was not able to successfully use this approach

0 Karma

harshpatel
Contributor

Hi @egonstep,

I created this hack earlier which might be helpful here. So It gives you behavior where you have multiple searches as your basesearch and then you combine all those search results into one search. Which is as follows:

Step 1: Define your searches as follows:

<search>
    <query>index="X" | stats count  | eval "search name"="search1"</query>
    <earliest>-24h</earliest>
    <latest>now</latest>
    <done>
      <set token="search1_sid">$job.sid$</set>
    </done>
  </search>
  <search>
    <query>index="Y" | stats count | eval "search name"="search2"</query>
    <earliest>-7d</earliest>
    <latest>now</latest>
    <done>
      <set token="search2_sid">$job.sid$</set>
    </done>
  </search>

Step 2: Now the sids will set when the searches are finished execution. Use them in the main search with loadjob command as follows:

| loadjob $search1_sid$
| append 
    [| loadjob $search2_sid$ ] 

As the searches ran parallel (having separate job for each search) and the results in the main search are fetched directly from the job sid, this way you can combine results of long-running searches without affecting them by append as before.

Edit: You can also split the search across multiple report searches.

Hope this was helpful.

Thanks,
Harsh

egonstep
Path Finder

Hey harshpatel, thanks for your answer.

But I have a question, this is to create a new dashboard to be sent as pdf, right?

0 Karma

harshpatel
Contributor

@egonstep, Yes it requires creating a dashboard. Also I've added an edit saying you can create multiple savedsearch as well like this. You can specify savedsearch name to loadjob command as well in your report search. For documentation (https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob).

0 Karma

egonstep
Path Finder

@harshpatel I see, thanks for the help, I'll try to create this way to see if everything works just fine.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...