Splunk Search

help to display a timechart after a loadjob command

jip31
Motivator

hello

I call a timechart from a loadjob command like below and it works

| loadjob savedsearch="admin:toto_sh:win timechart2" 

But I need to filter the events of my timechart by host because I use a text entry in my dashboard
Do I have to put the timechart count after the loadjob command like below or something else?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" 
| search host=$tok_filterhost$ 
| timechart count by sourcetype limit=10 useother=false

thanks for your help

0 Karma

alexforkosh
New Member

try loadjob with events argument set to true.

loadjob events=true savedsearch="admin:TOTO_sh:winevent timechart2"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

timechart will work only if your below search results has _time fields. Is this search has _time?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$

0 Karma

jip31
Motivator

Hi no
you can see my search below
perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

This search should work. Because I don't see any restriction on _time field. Is that possible to share more details about both searches ?

0 Karma

jip31
Motivator

Pearhaps I am not clear
The search below works fine :

perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

But I need to transform it in a scheduled search in order to call it from my dashboard and to be able to display the resulys for a specific host from a text entry
So I have deleted | search host=$tok_filterhost$ in my scheduled search and I have added

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" | search host=$tok_filterhost$ 

in my dashboard
But with this, I am unable to filter the resulys by host...
The scheduled search works fine if I delete | search host=$tok_filterhost$
So I try to find a solution...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...