Dashboards - - Common subsearch query

[pahilw]

Question on common subsearch query on dashboard - I have 6 panels on my dashboard and all the panels use same subsearch query to get list of hosts. Is there a way to execute this query only once and provide it as input to panels? List of hosts get updated every 5-10 minutes so they need to be dynamically retrieved.

[martin_mueller · Accepted solution]

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

[pahilw]

works great.