Dashboards & Visualizations

Dashboards - - Common subsearch query

pahilw
Explorer

Question on common subsearch query on dashboard - I have 6 panels on my dashboard and all the panels use same subsearch query to get list of hosts. Is there a way to execute this query only once and provide it as input to panels? List of hosts get updated every 5-10 minutes so they need to be dynamically retrieved.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

pahilw
Explorer

works great.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...