topic Re: Can anyone explain what is a Splunk Base Search? in Splunk Search

Can anyone explain what is a Splunk Base Search?

splgeek — Thu, 13 Oct 2016 03:20:48 GMT

Hello Splunkers

Can anyone explain in simple terms what is a Splunk Base Search?

Re: Can anyone explain what is a Splunk Base Search?

richgalloway — Thu, 13 Oct 2016 04:06:00 GMT

The term has two meanings. The first refers to the part of an SPL query prior to the first '|'.

The second is used in dashboards and refers to a search query the results of which are used in the later post-processed searches. See "Post-process searches" in http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches

Re: Can anyone explain what is a Splunk Base Search?

somesoni2 — Thu, 13 Oct 2016 04:50:58 GMT

Extending answer from Richard, the first part of the search is the base search. Consider this search:

index=_internal sourcetype=splunkd | stats count by source

The part before first pipe index=_internal sourcetype=splunkd is the base search. While in below search:

| tstats count WHERE index=_internal sourcetype=splunkd by source | table sourcetype

The first portion of the search | tstats count WHERE index=_internal sourcetype=splunkd by source is the base search.

Re: Can anyone explain what is a Splunk Base Search?

splgeek — Thu, 13 Oct 2016 15:21:43 GMT

Thank you guys

Re: Can anyone explain what is a Splunk Base Search?

hjauch_splunk — Mon, 17 Oct 2016 17:01:19 GMT

In the context of IT Service Intelligence, KPI base searches can be used to share a search definition across multiple KPIs that use the same data source. For example, you may have several KPIs that are based on the same sets of source events, but are measuring on different fields. You can create base searches to consolidate these KPIs, reduce search load, and improve search performance.

For info on KPI base searches, see http://docs.splunk.com/Documentation/ITSI/2.4.0/Configure/HowtocreateKPIsearches#Create_KPI_base_searches