Dashboards & Visualizations

How to find unique events in a dashboard with a base search and several post-process searches?

polssn
New Member

I have a dashboard which uses a base search that finds all events that we are interested in, then use post-process searches to classify this data into several different categories ("known concerns").

In the end, I want to display all events that are not picked up by any of these post-process searches, but I can't seem to find any primitive that would do this.

Basically, the logic I need is: BASE XOR (CATEGORY1 OR CATEGORY2 OR ...)

Ideally without having to duplicate the post-process searches again, since the results are already found.

0 Karma

mayurr98
Super Champion

So in short you need to filter out post process searches using NOT and OR operator.
Your query would be BASE NOT (CATEGORY1 OR CATEGORY2 OR ...)

Try this run anywhere XML

<dashboard>
  <label>Post Process Searches</label>
  <search id="Base_Search">
       <query>index=_internal | head 1000</query>
   </search>
  <row>

    <panel><title>ERROR</title>
      <event>
        <search base="Base_Search">
           <query>| search "ERROR"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>INFO</title>
      <event>
        <search base="Base_Search">
           <query>| search "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>WARNING</title>
      <event>
        <search base="Base_Search">
           <query>| search "WARNING"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
   <row>
    <panel><title>NOT "ERROR" NOT "WARNING" NOT "INFO"</title>
      <event>
        <search base="Base_Search">
           <query>| search NOT "ERROR" NOT "WARNING" NOT "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</dashboard>

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...