topic Is it possible to reference a report and add specific search criteria without having to create a new report with the needed criteria already specified? in Splunk Search

Is it possible to reference a report and add specific search criteria without having to create a new report with the needed criteria already specified?

apanages — Tue, 01 May 2018 17:29:52 GMT

Hello,

I have a report scheduled to run every night collecting patch information from many different business areas. This report has all the patching info in one master report. I am hoping to be able to reference that report in a search with other criteria, only pulling the specific information I want from that report such as specific IP ranges and other information.

I have tried ref=report_name | my_search_criteria but that did not work. Is it even possible to reference a report and adding specific search criteria without having to create a new report with the needed criteria already specified?

Thank you!

Re: Is it possible to reference a report and add specific search criteria without having to create a new report with the needed criteria already specified?

woodcock — Tue, 01 May 2018 18:50:52 GMT

There are many ways including:

This loads the last run:

| loadjob YourSavedSearchDetailsHere | search Your Search Criteria Here

OR (this runs it when you call it)

| savedsearch YourSavedSearchDetailsHere | search Your Search Criteria Here

OR (this runs it when you call it and you have to have "tokenized" the SPL in your saved search):

| savedsearch YourSavedSearchDetailsHere YourFirstCrteriaToken="YourFirstCriteraValue" ... YourLastCrteriaToken="YourLastCriteraValue"

Re: Is it possible to reference a report and add specific search criteria without having to create a new report with the needed criteria already specified?

somesoni2 — Tue, 01 May 2018 18:54:21 GMT

Are trying to do all these in a dashboard OR a search?

Re: Is it possible to reference a report and add specific search criteria without having to create a new report with the needed criteria already specified?

apanages — Tue, 29 Sep 2020 19:23:36 GMT

In a dashboard. My dashboard has a patch count for different sites (business locations). Instead of having that run the search every single time for each site when the dashboard is loaded, I ideally would like to have the dashboard reference my scheduled report that runs at night. I created a report that runs two days a week at night that has all the sites in one report. From there I would like to reference that report on my dashboard in different panels but only grab specific data from that one report showing only the data for the site represented in the specific panel.

Example:

Panel 1
Location 1: ref=report_name | search_criteria

Panel 2
Location 2: ref=report_name |search_criteria

I hope this makes sense.