Dashboards & Visualizations

Base search for two time ranges in splunk dashboard- data not coming in panel output when clicking open in search?

asplunk789
Loves-to-Learn Everything

I have a dashboard for common search query,  where i need to represent output of same search query in two time ranges. Time Range 1 and Time Range 2 added in input filters in dashboard. So now I am planning to create a base search for two different time ranges. After adding like below in the dashboard, data is not coming in panels output and when am clicking on open in search, output count is showing in query search. So please help me fix this issue. Below are the screenshots and base search's for reference. 

asplunk789_1-1680693491193.png

asplunk789_2-1680693730219.png

Base Searches : 

<search id="base_search_1">
<query>index=xxx source=xxx </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>

========================

<search id="base_search_2">
<query>index=xxx source=xxx </query>
<earliest>$field2.earliest$</earliest>
<latest>$field2.latest$</latest>
</search>

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @asplunk789,

Adding a table command makes searches run on the search head. That is why it is slow.

Base searches should be more specific. Returning all raw data to panels is not the best practice. Please use stats or timechart command on your base search as a preparation for your panels. 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

asplunk789
Loves-to-Learn Everything

Now the data coming after changed the base search query like below, but data loading in the panel is very very slow.

<query>index=xxx source=xxx | table * </query>

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...