I want to use common panels across many dashboards. This way I can modify one object, and update all related dashboards. This is an important software principle of Don't Repeat Yourself.
I know you can create a report and reference the same report in multiple prebuilt and inlined panels, but reports do not offer tokenized values.
Is there was a way to use a prebuilt panel that has a search, and reference its search by ID in additional panels?
You can do it like this:
|rest/services/data/ui/panels
| search eai:appName="Your App Here" AND panel.title="Your Panel Title Here" AND title="Your title here"
| regex eai:data = "\<query\>"
| rex field=eai:data max_match=0 "\<query\>(?<query>.*?)\<\/query\>"
| eval query=mvindex(query, <some number here>)
| map search="search $query$"
maybe look at the | loadjob
command?
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Loadjob
I'm looking to have a panel with an inline search with an ID.
Save that panel as a Prebuilt Panel.
Use that panel in a dashboard, and have other Prebuilt or Inline panels reference the first search as a base search.
Looking to keep things DRY.