topic Re: Multiple base searches in one search in Dashboards & Visualizations

Multiple base searches in one search

ektasardana — Tue, 07 Nov 2017 18:16:12 GMT

I have three base searches in my dashboard

 <query>....</query>


 <query>...</query>


 <query>...</query>

I need to show the results of each these queries in a single table, so I thought I can use multiple base searches, something like this

 <query>...</query>

Is there a way the above can be achieved?
Thanks!!

Re: Multiple base searches in one search

gcusello — Tue, 07 Nov 2017 18:52:29 GMT

No, in each panel you can use only one base search ti declare in search Tag.
If you want to speed up you sear h you have to use the Splunk acceleration methods.
Bye.
Giuseppe

Re: Multiple base searches in one search

elliotproebstel — Tue, 07 Nov 2017 19:39:30 GMT

Are you looking to append together the results of each search? I'm trying to understand the use case so that I can offer advice. There are probably many ways of achieving your end goal, so maybe you could give more details?

Re: Multiple base searches in one search

ektasardana — Tue, 29 Sep 2020 16:35:32 GMT

I have separate searches which all use a base search and calculate event duration.
Example: Base_search -> quite complex
search1 uses base_search results and output action1 duration
search2 uses base_search results and output action2 duration
search3 uses base_search results and output action3 duration

Now I want to display on a bar chart the durations with action on x axis and time on y axis.

PS: there is no easy way to combine all the results in one search, thats why I create separate searches

Re: Multiple base searches in one search

nick405060 — Tue, 09 Apr 2019 23:56:39 GMT

Yes, see

https://answers.splunk.com/answers/616340/is-it-possible-to-use-base-search-in-append-sub-se.html

Simply append multiple loadjobs. Also see:

https://answers.splunk.com/answers/738095/dashboard-search-optimization-only-run-searches-wh.html

Re: Multiple base searches in one search

nick405060 — Wed, 10 Apr 2019 00:00:03 GMT

I downvoted this post because no longer correct