Splunk Search

One-Table Combining Different Search Results in Real-Time

mlorrette
Path Finder

My end goal is to show events in one table coming from multiple searches in real time. They all have the same fields. appendcols usually works but not in real-time.

My ideas were:
-Each of the real-time searches will append its results to the same CSV; a different search will display that CSV in real-time.
-Create a dashboard with a panel for each search, somehow dynamically combine them; or at least make them look combined.

There's possible a much simpler answer for this which I'm missing. Any help appreciated!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) Never use appendcols. There is never a guarantee that the right items are being connected up. Also, if the searches all have the same fields, then appendcols makes no sense whatsoever. append is probably what you meant.

2) What you are doing pretty much guarantees that none of the source searches should be "real time". What splunk calls "real time" should only be used when the SLA for fixing whatever comes up is SECONDS. Instead, schedule a periodic search every 1m or 2m or 3m and you will get better performance and the same speed of viewing the data.

3) Consider a summary index. Each of your searches will scan the raw events and summarize them to the few columns that you need to know, then write them to a summary index. Your dash will read the summary index created by those other searches.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...