topic How can I reference searches across Prebuilt Panels in Dashboards & Visualizations

How can I reference searches across Prebuilt Panels

markbarber21 — Tue, 16 Jul 2019 14:28:09 GMT

I want to use common panels across many dashboards. This way I can modify one object, and update all related dashboards. This is an important software principle of Don't Repeat Yourself.

I know you can create a report and reference the same report in multiple prebuilt and inlined panels, but reports do not offer tokenized values.

Is there was a way to use a prebuilt panel that has a search, and reference its search by ID in additional panels?

Re: How can I reference searches across Prebuilt Panels

adonio — Tue, 16 Jul 2019 17:38:55 GMT

maybe look at the | loadjob command?

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Loadjob

Re: How can I reference searches across Prebuilt Panels

markbarber21 — Tue, 16 Jul 2019 19:40:14 GMT

I'm looking to have a panel with an inline search with an ID.
Save that panel as a Prebuilt Panel.

Use that panel in a dashboard, and have other Prebuilt or Inline panels reference the first search as a base search.

Looking to keep things DRY.

Re: How can I reference searches across Prebuilt Panels

woodcock — Fri, 19 Jul 2019 23:50:03 GMT

You can do it like this:

|rest/services/data/ui/panels
| search eai:appName="Your App Here" AND panel.title="Your Panel Title Here" AND title="Your title here"
| regex eai:data = "\<query\>"
| rex field=eai:data max_match=0 "\<query\>(?<query>.*?)\<\/query\>"
| eval query=mvindex(query, <some number here>)
| map search="search $query$"