Splunk Search

help to display a timechart after a loadjob command

jip31
Motivator

hello

I call a timechart from a loadjob command like below and it works

| loadjob savedsearch="admin:toto_sh:win timechart2" 

But I need to filter the events of my timechart by host because I use a text entry in my dashboard
Do I have to put the timechart count after the loadjob command like below or something else?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" 
| search host=$tok_filterhost$ 
| timechart count by sourcetype limit=10 useother=false

thanks for your help

0 Karma

alexforkosh
New Member

try loadjob with events argument set to true.

loadjob events=true savedsearch="admin:TOTO_sh:winevent timechart2"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

timechart will work only if your below search results has _time fields. Is this search has _time?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$

0 Karma

jip31
Motivator

Hi no
you can see my search below
perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

This search should work. Because I don't see any restriction on _time field. Is that possible to share more details about both searches ?

0 Karma

jip31
Motivator

Pearhaps I am not clear
The search below works fine :

perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

But I need to transform it in a scheduled search in order to call it from my dashboard and to be able to display the resulys for a specific host from a text entry
So I have deleted | search host=$tok_filterhost$ in my scheduled search and I have added

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" | search host=$tok_filterhost$ 

in my dashboard
But with this, I am unable to filter the resulys by host...
The scheduled search works fine if I delete | search host=$tok_filterhost$
So I try to find a solution...

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...