splunk - Splunk 在仪表板上进行基础搜索并后处理结果

问题描述

我有一个使用基本搜索的仪表板，以及 4 个其他面板，这些面板引用它并根据我要使用的图表以不同的方式格式化结果。

当我自己运行基本查询时，它会按预期返回数据。

基本查询：

index=mail sourcetype=barracuda bcProcess="outbound/smtp" 
    [ search index=mail sourcetype=barracuda 
        [ search index=mail sourcetype=sendmail_syslog msgid="<*@sfdc.net>" 
           | rex field=from "<(?<bcSender>.*)>" 
           | stats count by bcSender 
           | fields bcSender 
           | format 
        ] 
      | stats count by bcMsgId 
      | fields bcMsgId
    ]

在一个面板中，我显示了一个发送的总数，如下所示：

<search base="main_results">
  <query>
   | stats count(bcMsgId) as total
  </query>
</search>

与使用折线图每小时显示的另一个面板相同：

<search base="main_results">
  <query>
   | timechart span=1h count AS "Total Sends"
  </query>
</search>

引用基本查询时，上述两个面板都可以正常工作。

我遇到的问题是在饼图中。

<panel>
      <chart>
        <title>Send Action Breakdown</title>
        <search base="main_results">
          <query>| rename bcSendAction as "Send Action" 
| chart count as Total by "Send Action" 
| eval "Send Action"="Send Action"." (".Total.")" 
| replace 1 WITH "Success" , 2 WITH "Block" , 3 WITH "Deferral" IN "Send Action"</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="height">460</option>
        <option name="refresh.display">progressbar</option>
        <option name="charting.chart.showPercent">true</option>
      </chart>
    </panel>

当仪表板尝试加载此面板时，它始终返回“未找到结果”。但是，如果我将基本查询复制到搜索中，然后将此面板中的查询粘贴到其正下方，我会得到预期的结果。

问题：

当我可以手动粘贴这两个部分并且运行良好时，为什么这个面板使用相同的基本查询在获取数据时会出现问题？

Bounty Clarity 更新： 我的仪表板有 4 个面板，其中 3 个几乎使用相同的搜索查询，这就是我试图设置基本搜索以便他们都可以引用它的原因。

这是我对 4 个面板的 4 次单独搜索，如果它有助于显示我如何尝试将其拆分以使我的基础正常运行。

// Total Emails Sent
index=mail sourcetype=barracuda bcProcess="outbound/smtp" 
            [ search index=mail sourcetype=barracuda 
              [ search index=mail sourcetype=sendmail_syslog msgid="<*@sfdc.net>" 
                | rex field=from "<(?<bcSender>.*)>" 
                | stats count as Total by bcSender 
                | fields bcSender 
                | format 
              ] 
              | stats count as Total by bcMsgId 
              | fields bcMsgId, bcSendAction 
            ]
            | stats count(bcMsgId) as total


// Emails per hour
index=mail sourcetype=barracuda bcProcess="outbound/smtp" 
            [ search index=mail sourcetype=barracuda 
              [ search index=mail sourcetype=sendmail_syslog msgid="<*@sfdc.net>" 
                | rex field=from "<(?<bcSender>.*)>" 
                | stats count as Total by bcSender 
                | fields bcSender 
                | format 
              ] 
              | stats count as Total by bcMsgId 
              | fields bcMsgId, bcSendAction 
            ]
            | bin _time as hour span=1h
| stats count as hourcount by hour
| eval hour=strftime(hour,"%H:%M")
| chart sum(hourcount) as count by hour



// Top 10 Senders
index=mail sourcetype=sendmail_syslog msgid="<*@sfdc.net>"         
            | rex field=from "<(?<bcSender>.*)>"          
            | stats count as Total by bcSender
            | rename bcSender as "From Address"
            | sort -Total | head 10



// Action Breakdown
index=mail sourcetype=barracuda bcProcess="outbound/smtp" 
            [ search index=mail sourcetype=barracuda 
              [ search index=mail sourcetype=sendmail_syslog msgid="<*@sfdc.net>" 
                | rex field=from "<(?<bcSender>.*)>" 
                | stats count as Total by bcSender 
                | fields bcSender 
                | format 
              ] 
              | stats count as Total by bcMsgId 
              | fields bcMsgId, bcSendAction 
            ]
          | stats count as Total by bcSendAction
          | rename bcSendAction as Action
          | replace 1 WITH "Success" , 2 WITH "Block" , 3 WITH "Deferral" IN Action
          | eval "Action"=Action." (".Total.")"

标签： splunksplunk-querysplunk-formula

splunk - Splunk 在仪表板上进行基础搜索并后处理结果

问题描述

解决方案

推荐阅读