Question on common subsearch query on dashboard - I have 6 panels on my dashboard and all the panels use same subsearch query to get list of hosts. Is there a way to execute this query only once and provide it as input to panels? List of hosts get updated every 5-10 minutes so they need to be dynamically retrieved.
You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches
A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.
You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches
A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.
works great.