topic How to create root search and base search in dashboard? in Splunk Search

How to create root search and base search in dashboard?

Sekhar — Fri, 05 May 2023 06:10:47 GMT

We have created base serach query but I required to created root search base on that .

gcusello — Fri, 05 May 2023 05:44:08 GMT

what do you mean with "root search"?

you can create a base search (eventually more than one) in the top of your dashboard and call it in each panel, only one for each panel.

Could you share your code (please using the Add/Insert Code panel) and better describe what you need?

Ciao.

Giuseppe

Sekhar — Fri, 05 May 2023 05:56:12 GMT

<Query> index=x source= xtype application=xapps<\quer>

I am using base query in plannel

Panael

Serach base=" start event"

Query | status count working fine for panel

We have multiple base query index ,source, application same so i need to create one root search for comman search.

gcusello — Fri, 05 May 2023 06:04:46 GMT

to have the maximum advantage from a base search you should use a streming command (as stats, or chart, etc...) in the base search itself.

If it isn't possible, as in your case, you have to explicit the fields to use in the panels at the end of the base search using the fields command:

<search ID=" start event"> <Query> index=x source= xtype application=xapps | fields <fields used in the panels> <\Query>

I'll be more detailed if you could share your dashboard code and, please, put it in the using the Add/Insert Code panel.

Then don't use spaces in fields and base_search names.

Ciao.

Giuseppe