topic Annotation based on Existing Value (to avoid duplicate search) in Splunk Search

Annotation based on Existing Value (to avoid duplicate search)

lennys26 — Mon, 07 Nov 2022 13:05:34 GMT

On an existing dashboard I have a rather complex query that generates a timechart on which I am looking to use annotations to highlight threshold breaches.

Is there any way to avoid having to run the same query twice (once to create the initial chart, and a second time for the annotations).

Oh -- [I think I have may be answering my own question,] is the answer here going to be to use a base search?

Thanks.

Re: Annotation based on Existing Value (to avoid duplicate search)

richgalloway — Mon, 07 Nov 2022 15:12:35 GMT

Yes, a base search will be a good start.

Re: Annotation based on Existing Value (to avoid duplicate search)

lennys26 — Mon, 07 Nov 2022 15:48:59 GMT

@richgalloway - Thanks. I tend to shy away from base searches for some reason.