Reporting

Dashboard creation with two saved searches

MadhuriVanga
New Member

Hi,

I have two saved searches as follows:

1. abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload|timechart span=1d count by operation

2. abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=returncode //returnCode field=payload|timechart span=1d count by returncode

I want the dashboard count by operation and returncode in a single dashboard. i.e., i need a timechart which has adjacent bars for each operation and within each bar there should be color coded partition based on the returncode.

Kindly help with ideas on how to achieve the same.

Thanks in advance,
Madhuri.

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I believe you want a single search and report, not dashboard. Dashboard is easy (add two different panels with your searches) but a combined graph is inherently more difficult.

Try this:

abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload | xpath outfield=returncode //returnCode field=payload | eval ReportKey = operation.":".returnCode | timechart span=15m count by ReportKey

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I believe you want a single search and report, not dashboard. Dashboard is easy (add two different panels with your searches) but a combined graph is inherently more difficult.

Try this:

abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload | xpath outfield=returncode //returnCode field=payload | eval ReportKey = operation.":".returnCode | timechart span=15m count by ReportKey

0 Karma

MadhuriVanga
New Member

Hi sir,

Can we have three fields in the ReportKey? like we have 'operation' and 'returncode' can we have one more field included in the ReportKey?

Thanks in advance,
Madhuri.

0 Karma

MadhuriVanga
New Member

Hi,
Thanks a lot sir for the reply! It has helped me in getting the report right!!

Thanks once again.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...