topic Re: XML Base search is not working in Dashboards & Visualizations

XML Base search is not working

av_ — Wed, 21 Feb 2024 15:11:27 GMT

I'm trying to run a base search but it is throwing me an error. Reason being I have two search tags inside a panel.
EG:

Base search:

<search id="basesearch"> <query>index=main source=xyz </query> <earliest>$EarliestTime$</earliest> <latest>$LatestsTime$</latest> </search>

Panel search:

<chart depends="$abc$"> <title>Chart1</title> <search> <done> <eval abc="computer1"</eval> </done> <search base="basesearch"> <query> |search host="INFO" OR host="ERROR" panel=$panel1$ |timechart span=$TimeSpan$m count by panel usenull=f useother=f | eventstats sum("host") as _host</query> </search> <earliest>$InputTimeRange.earliest$</earliest> <latest>$InputTimeRange.latest$</latest> </search> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.drilldown">all</option> <option name="charting.fieldColors">{"host":0xFFFF00}</option> <option name="charting.legend.placement">bottom</option> <option name="refresh.display">progressbar</option> </chart>

Warning msg : Node <search> is not allowed here

Done section is required in the panel so I cannot remove it.
Is there a way to use a base search this way?

Re: XML Base search is not working

ITWhisperer — Wed, 21 Feb 2024 14:56:18 GMT

Try it like this: (I don't think you can change the time from what was used in the base search, and there should only be one level of <search></search>)

<chart depends="$abc$"> <title>Chart1</title> <search base="basesearch"> <query> |search host="INFO" OR host="ERROR" panel=$panel1$ |timechart span=$TimeSpan$m count by panel usenull=f useother=f | eventstats sum("host") as _host</query> <done> <eval abc="computer1"</eval> </done> </search> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.drilldown">all</option> <option name="charting.fieldColors">{"host":0xFFFF00}</option> <option name="charting.legend.placement">bottom</option> <option name="refresh.display">progressbar</option> </chart>

Re: XML Base search is not working

gcusello — Wed, 21 Feb 2024 18:07:33 GMT

Hi @av_ ,

if you don't have a streming command (as stats or timechart) in the base search, you must specify, at the end of the base search, all the fields that you need to use in the panels, in your case:

index=main source=xyz | fields host panel _time

Ciao.

Giuseppe

Re: XML Base search is not working

av_ — Wed, 28 Feb 2024 05:40:05 GMT

You're right @ITWhisperer, I can't change the time from what was used in the base search which brings me to my second question. How can I add a drilldown to the same panel with a different timestamp?
I want to expand the bar chart for a particular time to a drilldown containing more detailed information for that selected time frame.

Re: XML Base search is not working

PickleRick — Wed, 28 Feb 2024 11:49:51 GMT

You have a search element within a search element.

If you see here https://docs.splunk.com/Documentation/Splunk/9.2.0/Viz/PanelreferenceforSimplifiedXML#search search element is not allowed as a child of a search element.