How do you append a search query to a reports result?

[darioapis]

Hi,

I have a lot of data that I want to process on many graphs. So I created a report which will collect all HTTP logs that I need. But now, I have a problem with appending the search query to those search results, like showing graphs, lists or badges.

So to sum up, I would like to append the search query to the report's results.

Thanks

[mayurr98]

well post processing searches are efficient use for splunk dashboards but in your case you have a lot of raw data and your post search is depending on earliest and latest time which you cant use in base search.
so I would recommend you to remove base search and use full search for every report like this:

eventtype=nix-all-logs site="awstats" earliest=-60m latest=now | timechart span=5m count by site

you need to use same query for every report just that change earliest and latest time. I think this would be more efficient.

let me know if this helps!

[mayurr98]

Can you elaborate your question with sample input event details and output you want?

[darioapis]

I have generated report with this query:
eventtype=nix-all-logs (site="awstats") => That can take too long so that why it is report. So in my dashboard which have to results of that report. For example to show statistics like "| fields _time site | timechart count by site", but the problem is that I don't know how to append that search query to the result which I got from report.

[mayurr98]

can you try this :

eventtype=nix-all-logs site="awstats" | timechart count by site

[darioapis]

This is my base search.
https://pastebin.com/EhAwYfTy
The earliest is the problem. It should be on the another side of the pipe in generated search, which is: eventtype=nix-all-logs (site="awstats") | earliest=@h-1h latest=now | fields _time site
| timechart count by site

[mayurr98]

then make this as your base search

eventtype=nix-all-logs (site="awstats")  earliest=-60m latest=now  | fields _time site

[darioapis]

True, I have graphs for the last hour, last day, last week and last month. And the report is generated that save last month of data.

[mayurr98]

so you mean to say that your earliest time and latest is varying depending on the report and all the reports are in one dashboard and using the same base search?

[darioapis]

Yes, that is right.