Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Summary Index token drop down help

$
0
0
Hi Team, My current configs has drop down with one token , 3 choice value and 1 search query below. $api_cached_realtime_token$ is replaced by choice value as per 3 dropdown(All, RealTime, Cached ) Below is original code: AllRealTimeCachedapiActualTimeTakenapiActualTimeTakenindex=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | timechart span=1h avg($api_cached_realtime_token$) as AVG, P95($api_cached_realtime_token$) as P95$time_token.earliest$$time_token.latest$ Now I am moving into summary index. summary_index is = my_summary_index I am writing all the above into summary index by using search query below. ``index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | stats avg(apiActualTimeTaken) as AVG_Actual avg(realTime_timeTaken) as AVG_real avg(cached_timeTaken) as AVG_cached P95(apiActualTimeTaken) as P95_Actual P95(realTime_timeTaken) as P95_real P95(cached_timeTaken) as P95_cached`` Pls help me achieve same with 3 dropdown (All, RealTime, Cached ) that output search for respective drop-down. (one-token-multiple value-perhaps) index=my_summary_index | stats sum(AVG_Actual or AVG_real or AVG_cached ) as AVG sum(P95_Actual or P95_real or P95_cached) as per dropdown(All, RealTime, Cached ) respectively. I tried This article helped a bit but could not achieve yet. https://answers.splunk.com/answers/525245/how-to-pass-multiple-values-for-a-field-through-to-1.html

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>