Dashboards & Visualizations

How can I reference searches across Prebuilt Panels

Path Finder

I want to use common panels across many dashboards. This way I can modify one object, and update all related dashboards. This is an important software principle of Don't Repeat Yourself.

I know you can create a report and reference the same report in multiple prebuilt and inlined panels, but reports do not offer tokenized values.

Is there was a way to use a prebuilt panel that has a search, and reference its search by ID in additional panels?

0 Karma

Esteemed Legend

You can do it like this:

| search eai:appName="Your App Here" AND panel.title="Your Panel Title Here" AND title="Your title here"
| regex eai:data = "\<query\>"
| rex field=eai:data max_match=0 "\<query\>(?<query>.*?)\<\/query\>"
| eval query=mvindex(query, <some number here>)
| map search="search $query$"

0 Karma

Path Finder

I'm looking to have a panel with an inline search with an ID.
Save that panel as a Prebuilt Panel.

Use that panel in a dashboard, and have other Prebuilt or Inline panels reference the first search as a base search.

Looking to keep things DRY.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!