so you create a lookup scheduled_searches or whatever.

Sadly, that doesn't tell you when an object was created, so you'll have to maintain that state yourself in a lookup ( for some background). I'll use scheduled searches as an example, other objects work in a similar fashion.įirst, you'll want to find out what scheduled searches exist - query the relevant REST endpoint for that. RemoteSearch litsearch (user!=admin Number=3 index=scoreboard_admin time>=0.While there's no feature for this available out-of-the-box, it's quite simple to build your own.

Phase1 simpleresultcombiner max=0 | lookup ctf_users Username as user | search Result='Correct' | eval Team=if((Team != ''),Team,DisplayUsername), Team=if((Team != ''),Team,Username), Team=if((Team != ''),Team,user) | addinfo type=count label=prereport_events track_fieldmeta_events=true | timeliner remote=0 partial_commits=1 max_events_per_bucket=1000 fieldstats_update_maxperiod=60 bucket=300 extra_field=* | stats dc(user) as 'Users Who Completed' Phase0 litsearch (user!=admin Number=3 index=scoreboard_admin time>=0.000) | fields keepcolorder=t '*' 'DisplayUsername' 'Result' 'Team' 'Username' '_bkt' '_cd' '_si' 'host' 'index' 'linecount' 'prestats_reserved ' 'psrsvd_' 'source' 'sourcetype' 'splunk_server' 'user' OptimizedSearch | search (user!=admin Number=3 earliest=0 index=scoreboard_admin) | lookup ctf_users Username as user| search Result='Correct' | eval Team=if((Team != ''),Team,DisplayUsername), Team=if((Team != ''),Team,Username), Team=if((Team != ''),Team,user) | stats dc(user) as 'Users Who Completed' Provenance UI:Dashboard:question_investigator remoteSearch litsearch (user!=admin Number=3 index=scoreboard_admin _time>=0.000) | fields keepcolorder=t 'DisplayUsername' 'Team' 'Username' '_bkt' '_cd' '_si' 'host' 'index' 'linecount' 'source' 'sourcetype' 'splunk_server' 'user' When I do an inspection on the raw Search I get: Phase1 simpleresultcombiner max=0 | lookup ctf_users Username as user | eval Team=if((Team != ''),Team,DisplayUsername), Team=if((Team != ''),Team,Username), Team=if((Team != ''),Team,user) | timeliner remote=0 partial_commits=1 max_events_per_bucket=500000 fieldstats_update_maxperiod=60 bucket=0 Phase0 litsearch (user!=admin Number=3 index=scoreboard_admin _time>=0.000) | fields keepcolorder=t 'DisplayUsername' 'Team' 'Username' '_bkt' '_cd' '_si' 'host' 'index' 'linecount' 'source' 'sourcetype' 'splunk_server' 'user' OptimizedSearch | search (user!=admin Number=3 earliest=0 index=scoreboard_admin) | lookup ctf_users Username as user | eval Team=if((Team != ''),Team,DisplayUsername), Team=if((Team != ''),Team,Username), Team=if((Team != ''),Team,user) NormalizedSearch litsearch (index=scoreboard_admin user!=admin Number=3 _time>=0.000) | fields keepcolorder=t 'DisplayUsername' 'Team' 'Username' '_bkt' '_cd' '_si' 'host' 'index' 'linecount' 'source' 'sourcetype' 'splunk_server' 'user' When I do an inspection on the dashboard, this is what I getĭuration (seconds) Component Invocations Input count Output countĠ.00 1 1,070 1,070Ġ.00 1 1,070 1,070Ġ.00 _1_8 32 -Ġ.00 1 1,070 1,070Ġ.00 _directives 2 -Ġ.00 command.simpleresultcombiner 3 317 317Ġ.00 dispatch.createdSearchResultInfrastructure 1 -Ġ.00 2. Also, I have another post-processing search based on the same base search that does work just fine. The original post-processing search only returns about 300 records so not worried about hitting that limit. Įarliest=0 index=scoreboard_admin user!=admin $QuestionNum$ `get_user_info` When I put it in my dashboard (as a post-processing search, I don't come up with anything. | stats dc(user) as 'Users Who Completed' The raw search is: earliest=0 index=scoreboard_admin user!=admin Number=3 `get_user_info` I have a very simple query that runs correctly in search, but when I try to use it on a dashboard, it doesn't come back with anything. When I just do the 2nd line of the sub-search it works fine. Is what is actually giving me problems on the dashboard coming out of the post processing search. Update: So doing a little more investigation it looks like the line | search Result='Correct'

Splunk base query dashboard