Splunk Search

statement optimization because the link is the same for more condition. I like to use or operator

w044f
New Member

how can i optimize this statement :

       <condition field="title">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
       </condition>

       <condition field="Site">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="response">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="last_checked">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="response_time">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="average">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="range">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="sparkline_response_time">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="Serveur">
           <link>
              <![CDATA[/app/website_monitoring/status_history?form.title=$row.Serveur$&earliest=$earliest$&latest=$latest$]]>
            </link>
        </condition>

        <condition field="packet_loss">
           <link>
              <![CDATA[/app/website_monitoring/status_history?form.title=$row.Serveur$&earliest=$earliest$&latest=$latest$]]>
            </link>
        </condition>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you omit the field="..." attribute then one condition will apply to all fields.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...