Dashboards & Visualizations

using "eval" in a search form - results table not updating

briang67
Communicator

Hello,

I'm trying to get a form search to work where based on "group" I want an "eval" field called total_bytes to show up in a data table on my dashboard view. My search below works correctly from the search bar, but when I add as a form to a custom view, my result set does not show total_bytes.

Can someone help me to determine what's wrong?
Here's the search that works:

index=nc3sec sourcetype=syslog jav20023: | eval total_bytes = sent + rcvd | stats sum(total_bytes) by group

Here's my xml for the form:



<!-- define master search template; leave time unbounded so that the time input can be used -->
index=nc3sec group="$group$"



<!-- Define a radio button list, populated from a search. searchWhenChanged propagates any change in selection immediatly to the results. -->





Any

<![CDATA[index=nc3sec sourcetype=syslog jav20023: | eval total_bytes = sent + rcvd | stats sum(total_bytes) by group]]>

  <!-- add default TimePicker -->  
  <input type="time" />  

  <!-- show results in event viewer -->  
  <table>  
    <title>Total Bytes By Group</title>  
    <option name="count">50</option>  
  </table>  

Tags (1)
0 Karma

Takajian
Builder

I am not sure if this solve your problem. Could you try following search?

"sourcetype=syslog jav20023: | eval total_bytes = sent + rcvd | stats sum(total_bytes) AS total by group | table total group "

Your field "total_bytes" seems not appear just in your row table view. So, I think using table command will help this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...