https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544843#M37375 <P>Thanks,&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/214410">@isoutamo</a>&nbsp;, I should have read&nbsp;<A href="https://www.tekstream.com/optimizing-splunk-dashboards-with-post-process-searches/#:~:text=If%20the%20base%20search%20is,for%20the%20post%2Dprocess%20search." target="_self">Optimizing Splunk Dashboards with Post-Process Searches</A>&nbsp;, now I got my searches optimized and problem has gone.</P> Mon, 22 Mar 2021 23:00:13 GMT afsku 2021-03-22T23:00:13Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544820#M37373 <P>Hi,</P><P>I have two identical queries on the dashboard, the only difference - one is based on previously defined search results.&nbsp; They produce very different charts however, here is the code and screenshots:</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;form&gt; &lt;search id="events_search"&gt; &lt;query&gt; index = "*" | fields * &lt;/query&gt; &lt;earliest&gt;$time_token.earliest$&lt;/earliest&gt; &lt;latest&gt;$time_token.latest$&lt;/latest&gt; &lt;/search&gt; &lt;fieldset submitButton="false" autoRun="true"&gt; &lt;input type="time" token="time_token"&gt; &lt;label&gt;Time&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-48h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Errors (Based on events_search query)&lt;/title&gt; &lt;search base="events_search"&gt; &lt;query&gt; search level IN ("error", "fatal") | timechart count &lt;/query&gt; &lt;/search&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Errors (Not based on any existing query)&lt;/title&gt; &lt;search&gt; &lt;query&gt; index = "*" | fields * | search level IN ("error", "fatal") | timechart count &lt;/query&gt; &lt;earliest&gt;-48h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2021-03-22 at 1.45.31 PM.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/13438i77732711126E367A/image-size/large?v=v2&amp;px=999" role="button" title="Screen Shot 2021-03-22 at 1.45.31 PM.png" alt="Screen Shot 2021-03-22 at 1.45.31 PM.png" /></span></P><P>&nbsp;</P><P>So I wonder if it is a bug or some sort of known behavior?&nbsp;</P> Mon, 22 Mar 2021 19:52:38 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544820#M37373 afsku 2021-03-22T19:52:38Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544831#M37374 <P>Hi</P><P>This is known limitation of using none transforming base search. It return only xx k (500k if I recall right) results.</P><P>r. Ismo&nbsp;</P> Mon, 22 Mar 2021 21:19:20 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544831#M37374 isoutamo 2021-03-22T21:19:20Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544843#M37375 <P>Thanks,&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/214410">@isoutamo</a>&nbsp;, I should have read&nbsp;<A href="https://www.tekstream.com/optimizing-splunk-dashboards-with-post-process-searches/#:~:text=If%20the%20base%20search%20is,for%20the%20post%2Dprocess%20search." target="_self">Optimizing Splunk Dashboards with Post-Process Searches</A>&nbsp;, now I got my searches optimized and problem has gone.</P> Mon, 22 Mar 2021 23:00:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-Base-search-results-differs-from-no-same-query-results/m-p/544843#M37375 afsku 2021-03-22T23:00:13Z