Dashboards & Visualizations

Can search results be reused in multiple secondary join searches?

DrColombes
New Member

Can the results of a primary search be reused (without recomputing the primary search) in multiple joins with different secondary searches that go to separate panels in a dashboard?

Something like

| join [] in dashboard panel 2,
| join [] in dashboard panel 3,
| join [] in dashboard panel 4, etc?

Thanks.

Tags (2)
0 Karma

Ayn
Legend

Not entirely sure how you're defining "app" and a secondary join in this context, but if you mean using a base search in a dashboard and then process its results in different ways for different panels, then sure. Have a look at the docs regarding post processing: http://docs.splunk.com/Documentation/Splunk/latest/Developer/PostProcess

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...