I have three base searches in my dashboard <query>....</query> <query>...</query> <query>...</query> I need to show the results of each these queries in a single table, so I thought I can use multiple base searches, something like this <query>...</query> Is there a way the above can be achieved? Thanks!! ... View more

I have a base search query which is quite complicated and I want to use that to calculate multiple stats and display all of them on a single chart. I am having a hard time to solve this problem in Splunk. When searched, found multiple options to do it but nothing really works. 1. Use append and sub search - need the output from base search. not a neat way to copy the big and complicated search again and again 2. Cannot just refer to base search again in sub searches High level overview of the problem I am trying to solve: base search returns Time --- #Action --------- #id1 ---------- #id2 ------------- #id3 _time, event A send, sessionAid _time, event B send, -------------- sessionBid _time, event A recv, sessionAid _time, event B recv, --------------- sessionBid _time, event C send, ---------------------------------- sessionCid _time, event C recv, ---------------------------------- sessionCid I need to calculate the duration between each event's send and receive. I am using stats command for that. base search results| eval eventA_send_time = ### | eval eventA_recv_time = ###| stats values(eventA_send_time) as send_time values(eventA_recv_time) as recv_time by sessionAid| mvexpand recv_time | eval A_time = recv_time - send_time Similarly for Event B and C. This works fine if run individually but I need to display durations of event A, B and C on a chart. Can someone explain how this can be achieved. Really appreciate your help!! ... View more

Lets say I have a table with fields A, B, C, D. I would like to color rows based on the values of column D. Basically rows with same value of column D, should be in the same color. Is there a way this can be achieved in Splunk? Any help related to this will be appreciated! ... View more