Splunk Search

adding fields to a simpleResultsTable?

dlovett
Path Finder

This should be a simple search to find the age of unresolved help desk tickets. I'm new to splunk thus there may be a better way to to this. I simply want to display the results in a simpleResultsTable on a dashboard using advanced XML except I can't get "myField" to show up in a SimpleResultsTable. Any thoughts?

<module name="HiddenSearch" layoutPanel="panel_row2_col2" group="Oldest Unsolved Tickets" autoRun="True">

<param name="search">sourcetype=Remedy_Tickets | transaction ID CreateDate | where eventcount=1 AND QueryType="CREATED" | eval myField=round((now - CreateDate)/60/60/24, 1) | sort CreateDate</param>

<param name="earliest">-7d@d</param>

<param name="latest">@d</param>

<module name="SimpleResultsTable">

<param name="fields">_time ID Group myField</param>

</module>

</module>

0 Karma

dlovett
Path Finder

Actually, this appears to give the results I'm looking for:

sourcetype=Remedy_Tickets | transaction ID CreateDate | where eventcount=1 AND QueryType="CREATED" | eval dur=round((now() - CreateDate)/60/60/24, 1) | stats values(ID) as ID, values(Group) as Group, values(dur) as Days | sort CreateDate
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!