I am trying to make it so if a user clicks on any cell in a Dashboard showing a Statistics table, that will result in a search being launched in a new tab. The "Auto" search does exactly what I want it to do, so I want to be able to use that, but have it launch in a new tab.
There is no option to enable that in the UI.
There are a number of answers in here which show to add the following to the XML.
The problem is that "target" is part of the link structure. I don't have a link defined because I am using the Auto search. Is there a way to do this without adding a custom search? My search is very long and contains a number of characters (? and &) which then fail in the XML code, so I am manually making many updates to the XML for any change that I make to the search. It is quite tedious.
Any help would be appreciated.
... View more
I have been able to get this working as I need. Here is what I did incase anyone else is looking to do something similar:
eval temp=mvindex(split(http_request,"/"),-2) |
eval temp2=mvindex(split(temp,"?"),0) |
eval api=mvindex(split(temp2," "),0) | fields rtt api |
eventstats perc95(rtt) as p95Resp by api|
eval p00Unit=1 |
eval p95Response=if(rtt<=p95Resp,rtt,null()) |
stats count(p00Unit) as Count, avg(rtt) as Average avg(p95Response) as 95PercentileAvg perc95(rtt) as 95thPercentile count(p95Unit) as 95thPercentileCount by api
| foreach 95PercentileAvg 95thPercentile Average [eval <>=round('<>',2)] | sort -num(Count)
... View more
I am using splunk to ingest haproxy logs. Our HAproxy forwards requests onto a number of different servers for access to various APIs. Currently I have some reports to find the average repsonse times, 95th percentile etc for these different API calls. The current reports do searches on strings for the APIs and to generate the report. The API strings are hard coded in the reports. For example here is the framework of one of the reports:
sourcetype=haproxy:http status=200 ("api1_string?" OR "api2_string?" OR "api3_string?" OR "api4_string?" ) | eval API=case(searchmatch("api1_string?"),"api1",
|stats avg(rtt) as AveragePerRequest, perc95(rtt) as 95thPercentile, count as Count by API | eval AveragePerRequest=round(AveragePerRequest,2)
Ideally I could have the strings for the searchmatches and the original search created dynamically.
The field to be evaluated for the api calls is the http_request field from the haproxy log. A couple of examples of
GET /path1/API?option1=answer2&option2=answer2 HTTP/1.1
POST /path1/path2/path3/path4/API HTTP/1.1
So basically the API will be the last path in the http_request dropping the query parameters that come after the ? if there.
So is it possible to dynamically generate the list of APIs for feeding into the report?
I have reviewed quite a bit of documentation, but I have not found anything that might help with this.
... View more