Splunk Search

help to display a timechart after a loadjob command

jip31
Motivator

hello

I call a timechart from a loadjob command like below and it works

| loadjob savedsearch="admin:toto_sh:win timechart2" 

But I need to filter the events of my timechart by host because I use a text entry in my dashboard
Do I have to put the timechart count after the loadjob command like below or something else?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" 
| search host=$tok_filterhost$ 
| timechart count by sourcetype limit=10 useother=false

thanks for your help

0 Karma

alexforkosh
New Member

try loadjob with events argument set to true.

loadjob events=true savedsearch="admin:TOTO_sh:winevent timechart2"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

timechart will work only if your below search results has _time fields. Is this search has _time?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$

0 Karma

jip31
Motivator

Hi no
you can see my search below
perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

This search should work. Because I don't see any restriction on _time field. Is that possible to share more details about both searches ?

0 Karma

jip31
Motivator

Pearhaps I am not clear
The search below works fine :

perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

But I need to transform it in a scheduled search in order to call it from my dashboard and to be able to display the resulys for a specific host from a text entry
So I have deleted | search host=$tok_filterhost$ in my scheduled search and I have added

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" | search host=$tok_filterhost$ 

in my dashboard
But with this, I am unable to filter the resulys by host...
The scheduled search works fine if I delete | search host=$tok_filterhost$
So I try to find a solution...

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...