Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

passing data from Global search to child search not displaying data on dashboard.

$
0
0
Hello, In my dashboard, I am using one global search and multiple sub search queries(which use global search query data). Issue is data is not getting displayed on dashboard, but when i click on search button its append sub search to global search and displaying results. Now sure why its not getting displayed on dashboard. **Global Search** eventtype=mlc_live host=$host_token$ sourcetype=tool_lifecycle $time_token.earliest$$time_token.latest$ **Sub Search** | eval ScriptName2=ScriptName | rex field="ScriptName" "^\S+_(?<ScriptName>[^\.]+)\.\S+" | rex field="ScriptName2" "^\S+\.sh\s*(?<Instance>\S+)" | rex field="ActivityType" "^#(?<ActivityType>[^\.]+);" | eval ActivityType=if(isNOTNULL(ActivityType),ActivityType,"NA") | search ScriptName IN (*$script_name_token$*) AND ActivityType = "*$activity_type_token$*" AND Status = "*$status_token$*" | table _time ScriptName Instance StartDate StartTime EndDate EndTime Duration UniqueIdentifier Status ActivityType | sort 0 _time desc | dedup UniqueIdentifier$time_token.earliest$$time_token.latest$ ![alt text][1] [1]: /storage/temp/219597-search-query.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>