Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is it possible to use two base searches in one post-processing search?

$
0
0
I have a dashboard similar to this one:
hosthosttrue
index=_internal | eval count = 1 | timechart per_minute(count) as rate by host-10m@m@m index=_internal | stats count as count by host | addinfo | eval rate=count * 60 / (info_max_time - info_min_time) | fields host rate-20m@m-10m@mBaseline where host=$selectedHost|s$ | fields rateTimechart with baseline overlay fields _time $selectedHost|s$ | eval baseline = 123
Instead of the hard-coded value "123" in the search "Timechart with baseline overlay" i want to use the "rate" field which is calculated in the "statsBase" search. I could not find anything suitable in the documentation. Is this even possible? As I workaround I tried to use the `loadjob` command to access the result of the second base search as shown in the code below:
hosthosttrue
index=_internal | eval count = 1 | timechart per_minute(count) as rate by host-10m@m@m index=_internal | stats count as count by host | addinfo | eval rate=count * 60 / (info_max_time - info_min_time) | fields host rate-20m@m-10m@m$job.sid$Baseline where host=$selectedHost|s$ | fields rateTimechart with baseline overlay fields _time $selectedHost|s$ | eval [ | loadjob $sid|s$ | where host=$selectedHost|s$ | return baseline=rate ]
When I open the panel in search using the magnifier icon, the generated search works perfectly however. I'm on Splunk enterprise 6.3.1 by the way.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>