Dashboards & Visualizations

Base search for two time ranges in splunk dashboard- data not coming in panel output when clicking open in search?

asplunk789
Loves-to-Learn Everything

I have a dashboard for common search query,  where i need to represent output of same search query in two time ranges. Time Range 1 and Time Range 2 added in input filters in dashboard. So now I am planning to create a base search for two different time ranges. After adding like below in the dashboard, data is not coming in panels output and when am clicking on open in search, output count is showing in query search. So please help me fix this issue. Below are the screenshots and base search's for reference. 

asplunk789_1-1680693491193.png

asplunk789_2-1680693730219.png

Base Searches : 

<search id="base_search_1">
<query>index=xxx source=xxx </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>

========================

<search id="base_search_2">
<query>index=xxx source=xxx </query>
<earliest>$field2.earliest$</earliest>
<latest>$field2.latest$</latest>
</search>

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @asplunk789,

Adding a table command makes searches run on the search head. That is why it is slow.

Base searches should be more specific. Returning all raw data to panels is not the best practice. Please use stats or timechart command on your base search as a preparation for your panels. 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

asplunk789
Loves-to-Learn Everything

Now the data coming after changed the base search query like below, but data loading in the panel is very very slow.

<query>index=xxx source=xxx | table * </query>

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...