Splunk Search

How to get the exact row from a results table to use for other panel searches in the same dashboard?

belladonna
New Member

Hello!

I want to make an error monitoring dashboard. I want to have a table with (operation| okOperations/allOperations) and 4 timechart panels with top-error operations, that work dynamically.

For the first table I have a search

index=prt result=*
| eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation 
| eval ratio=1-okOp/totalOp|stats max(ratio) as ratio by operation | sort 3 -ratio

It returns result table

<table>
    <tr>
        <td>operation</td>
        <td>result</td>
    </tr>
    <tr>
        <td>check</td>
        <td>1</td>
    </tr>
    <tr>
        <td>search</td>
        <td>0. 2</td>
    </tr>
    <tr>
        <td>buy</td>
        <td>0.2</td>
    </tr>
</table>

Now I want to use operations names in 3 new searches (for 3 panels) like this:
|rownum = 1 |timechart count(operation) by result

|rownum = 2 |timechart count(operation) by result

|rownum = 3 |timechart count(operation) by result

I don't want to use | streamstats count as rownum, because it works very slowly. How can I make a search for panels?
It will be good to use hidden search and then reuse its results in panels.

0 Karma

sundareshr
Legend

Like this

*For the first row*

 ... | head 1

*For the second row*

... | head 2 | tail | head 1

**** For the third row****

... | tail 1
0 Karma

spunk_enthusias
Path Finder

Is there really no better way than this?

0 Karma

belladonna
New Member
 index=prt result=*
 | eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation 
 | eval ratio=1-okOp/totalOp|stats max(ratio) as ratio by operation | sort 3 -ratio| head 1|timechart count(operation) by result 

doesn't return anything

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...