All Apps and Add-ons

Automatic Simple XML Dashboard: How to remove an unwanted pipe in the base search of a dashboard?

TiagoTLD1
Communicator

Hello,

I have a base search as simple as

<search id="root">
    <query>index=w                     
     </query>
  </search>

And the I have

<search base="root">
  <query> filter1=A AND filter2=B
 </query>
</search>

This is not working because Splunk adds a pipe between the root and leaf search:

index=w | filter1=A filter2=B

What I wanted to happen is

index=w filter1=A filter2=B

Any ideas how to change this behaviour?

0 Karma
1 Solution

cmerriman
Super Champion

try this

<search base="root">
   <query> search filter1=A filter2=B
  </query>
 </search>

You're not going to be able to remove that pipe. it's either add the filters to the base search or do a |search in the base="root"

View solution in original post

0 Karma

cmerriman
Super Champion

try this

<search base="root">
   <query> search filter1=A filter2=B
  </query>
 </search>

You're not going to be able to remove that pipe. it's either add the filters to the base search or do a |search in the base="root"

0 Karma

TiagoTLD1
Communicator

Thank you, that was my suspition. I'll have to live with that.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...