i have a query template already made.
i want to run this query on X (the number will change all the time) amount of distinct description that are being returned through another query.
how can i do that?
query that run on every distinct description:
index="event_raw_data" description="somedescription" | fillnull value="NO Description" description | timechart count by description useother=f
query that return the description:
index="event_raw_data" | table description | dedup description
i want to combine the two so that the first query will run on every distinct result of the first
You need to program the first search by using the second search as a subsearch
like this:
index="event_raw_data" [index="event_raw_data" | stats values(description) AS description] | timechart count by description useother=f
As far as creating/using one search as a template for another search, carefully read about savedsearch
and all that it can do in this regard using placeholders
:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch
That is what map
is for, but beware of dangerous scaling:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map
However, I strongly suspect that you are not accurately describing what you really need to do here.
Try like this
index="event_raw_data" [search index="event_raw_data" ..other search terms if any...| stats count by description | table description]
| timechart count by description useother=f
hope i understand your question
try this:
index="event_raw_data" description="somedescription" | timechart limit=0 count by description
let the timechart
command dedup for you
as a side note, its always better to dedup
before table