SPLUNK DASHBOARD BASE SEARCH HOW TO

Search ProductName='Google Chrome' | stats count Index='index_name' (ProductName='Google Chrome' OR ProductName='Skype') | stats Chrome I ran my query like this below but somehow result is not coming. Index='index_name' (ProductName=#1# OR ProductName=#2# OR ProductName=#3# OR etc.) Note, you were missing in your base search, and the use of dedup is unnecessary if you are just counting hosts by ProductName. If so, you would want to do the following. If I interpreted things correct, my guess is you want to display the number of hosts for specific products. It seems like you left some details from your original post.

You can also use the back-tick character to wrap code. That will give you a text box to enter code.

SPLUNK DASHBOARD BASE SEARCH HOW TO

“index='index_name' (ProductName= #1# OR ProductName= #2# OR ProductName= #3# OR etc.) | dedup host, ProductName | stats countīasically, where I got stuck is I want the stats count but while filtering product name do I need to mention in the base query or later in the main query and how to do that for different product_name in different dashboard panels referring to base search.įirst, note that you can post code/xml is readable format using the button on the text format toolbar that looks like two rows of binary numbers. Note: Using - instead of html tag as it is not allowing while posting this post. no of Chrome, Mozilla, Skype, etc in different panels.įiltering search query likely Product_name = 'Chrome' OR Product_name='Skype' With the help of base search, I want to prepare a dashboard where can get the display of different applications installed in the network respectively. I am new to base search and need some help from you.

Splunk dashboard base search