Hello Splunk Experts,
Our organization has multiple applications. A work item, such as an order, passes through various applications and the actions performed on this work item are logged. Differen...
See more...
Hello Splunk Experts,
Our organization has multiple applications. A work item, such as an order, passes through various applications and the actions performed on this work item are logged. Different apps have different log formats.
Here's what I am trying to do with my dashboard. When a user enters a work item # in the dashboard input, it will show the "journey" of that work item as it is processed by each app and passed on. I have panels on the dashboard to indicate the log entry of when it was received, processed and the passed on to the next app in the chain. Now, I am trying to get a bit more creative.
In addition to the panels on the dashboard, I am planning to have a label on the dashboard with a story-template such as
---
"An order with item placed by <username extracted from first or nth search result of app1> with <item # from input> arrived for processing at <time from first or nth search result of app1>. Then it was passed on to app2 at <time from first or nth search result of app 2>.
<if there is any error then> The item encountered error in app2. Error is <error extracted from search result of app2>, etc. Please contact blah blah
---
So the idea here is to generate a human-readable "story", i.e. a text generated based on search results of each panel, so that someone looking at the dashboard does not have to examine multiple panels to understand what is going on. They can simply read this "story".
I am able to get the resultCount using <progress> and <condition> tags in the dashboard, but do not know how to fetch and examine first or nth search result, or look for some specific text such as error or the time for nth result within the search results displayed in the panel for a particular app.
Any hints or specific examples appreciated.
Thanks much!