Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Multiple Search Templates In Dashboard

$
0
0
Hi, I wonder whether someone may be able to help me please. I've put together the following form.
|rest /services/search/jobs |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" |search author =$author$ |addtotals fieldname=duration *duration_secs |convert rmunit(duration) as numSecs |eval stringSecs=tostring(duration,"duration") |eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s") |rex field=stringSecs "\.(?\d{2})" | rex field=stringSecs "(?.+)s\." |eval stringSecs=myRest. "s " .ms. "ms" |eval NoOfDays=floor((searchLatestTime-searchEarliestTime)/(3600*24)) |eval earliestTime=strptime(earliestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(earliestTime) |eval latestTime=strptime(latestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(latestTime) |eval daterange= "From: ".earliestTime.", To: ".latestTime |makemv delim=", " daterange |sort +author |table author eai:acl.app title daterange NoOfDays stringSecs |rename author as "Search Author", eai:acl.app as "App Used", title as "Query", daterange as "Query Date Range", NoOfDays as "Query Date Range (Days)", stringSecs as "Query Runtime"
-7d@hnow|rest /services/search/jobs earliest=$timerange.earliest$ latest=$timerange.latest$ |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" |stats count by authorAnyauthorauthor
Splunk Searches Performed - Results for $author$
Searches With The Query Time Range Greater Than or Equal To 90 Days|rest /services/search/jobs |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" |search author =$author$ |addtotals fieldname=duration *duration_secs |convert rmunit(duration) as numSecs |eval stringSecs=tostring(duration,"duration") |eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s") |rex field=stringSecs "\.(?\d{2})" | rex field=stringSecs "(?.+)s\." |eval stringSecs=myRest. "s " .ms. "ms" |eval NoOfDays=floor((searchLatestTime-searchEarliestTime)/(3600*24)) |where NoOfDays>=90 |eval earliestTime=strptime(earliestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(earliestTime) |eval latestTime=strptime(latestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(latestTime) |eval daterange= "From: ".earliestTime.", To: ".latestTime |makemv delim=", " daterange |sort +author |table author eai:acl.app title daterange NoOfDays stringSecs |rename author as "Search Author", eai:acl.app as "App Used", title as "Query", daterange as "Query Date Range", NoOfDays as "Query Date Range (Days)", stringSecs as "Query Runtime"
Although the drop down menus work, the queries return the desired results, the problem I have relates to the second panel in the dashboard. When I select the values from the drop down menus on the dashboard the query from the first panel runs in the second, rather than the query I've coded into the xml. I suspect it's because each query is within the same named "SearchTemplate", but I cannot be sure. I just wondered whether someone may be able to look at this please and offer some guidance on how I can overcome this issue. Many thanks and kind regards Chris

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>