Implementing Splunk 7, Third Edition - Third Edition

An illustration

To illustrate a simple example, we can consider a timecount query within a Splunk dashboard. Opening an existing dashboard, we see the following query that counts the occurrences of the text error within machine logs that are indexed in source type's names starting with tm1:

sourcetype="tm1*" error | timechart count 

Suppose we know that there are times when various ETL processes are inactive and want to correlate these events with the count of errors occurring. We can create the following event annotation query:

<query>sourcetype="tm1*" error | timechart count</query> 
             <earliest>-30week</earliest> 
          <latest>-1weeks</latest> 
               <sampleRatio>1</sampleRatio> 

We then add it to the XML of our dashboard (using search type="annotation" ...