Reporting

Create a report with two different time ranges

vkmurthy
New Member

I have a report created which analyzes my data over the past 30 days.

Then I have a dashboard, with three different searches/panels that analyzes specific data over the last 24 hours.

I would like to put the data from this dashboard into the same report. This would be highly convenient to see everything on one page by Id which is a field. If the data is not available for the past 24 hours, but exists over 30 days, that cell should be empty .

More specifically, in the 30 day report I search for all units that have been online in the past 30 days, and then put them in a table.

Id="*" Status="*" earliest=-30d latest=now
| dedup Id
| table _time Id customer Status Number_of_Days_Since_Comms

in the dashboard, my three searches create sparklines or tables.

Id="*" metrics1="0.0"
|chart sparkline(avg(metrics1)) as "Metrics1 over 24 Hours" by Id

Id="*" metrics2="0.0"
|chart sparkline(avg(metrics2)) as "Metrics2 over 24 Hours" by Id

Id="*" (metrics3<="X" OR metrics4<"Y")
|table _time Id metrics3 metrics4 

How can I combine these into a single report?

0 Karma

woodcock
Esteemed Legend

I have no idea what you really need here. Please edit/comment and add much more detail.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...