Hello, I am trying to make a saved search dynamic. It is used on a dashboard, and by default it shows all sources with a time range of today. Performance is fine for this, but when I select a time range larger (a week for example) it is very slow. I have a source picker which filters the results of the saved search (inside of some post process searches), but what I want to do is actually modify the query itself. This way, I can pick a source and search for a longer time range quickly. Tokens would be the easiest way to do this, but I don't know if it can be done. Thanks! ... View more

Hello, I am building a dashboard for system performance monitoring. There are 14 system calls that I need to keep track of. Some days, some of those calls are never made. The dashboard is created using HTML and SplunkJS, and specifically uses an UnderscoreJS data template view. The data template only renders a view for each result that is returned (this is important for our team, because we want this dashboard to be reusable and modular for other teams). So, if say only 10 of the 14 services have been called today, then only 10 boxes get rendered. We want all 14 boxes to be rendered, with the uncalled services being gray boxes with values of zero in their display. I know that I can append rows to a stats table using the append command. Here is an example. What I need to do is conditionally perform this append, if some of those services have not been called. In essence: search ... | stats ... | IF ( service=serviceName is missing ) THEN ( append [ eval service=serviceName | eval count=0 | eval mean=0 | eval perc95=0 ] ) I would end up writing 14 of these conditionals in total, one for each service name. I greatly appreciate any help! ... View more