I'm sorry if this question has already been asked, but I'm still a newbie in Splunk so please be gentle with me 🙂
In this case, u can just link the relevant question/answer.
I want to build a Dashboard with different Input types, that is generating the results of a report. I already know, that this is quite simple with an inline search, but I want to use the Dashboard explicitly with a report/savedsearch.
To sum up: I wanna have a Dashboard, where u can use a text input/radio buttons etc. to let the report know, what it has to search for.
The idea is that I wanna build a couple of Reports that are implemented in a few different Dashboards. If I should change sth. in one of those reports, the changes shall affect the Dashboards as well, so that I don't have to make all these changes for every single Dashboard.
I hope my problem gets clear.
Thanks and Regards
@qxu5715, you can refer to following documentation to add a Saved Search (Report) as a panel in Dashboard.
Another option for you would be to use Saved Search command for the report inside dashboard
<search><query> to get the results. With the
savedsearch, you can pipe in your own filters on the existing search.
Ideally you would use Schedule a Saved Search and use that in your Dashboard Panel so that results from previous run of scheduled search is loaded on your dashboard and each time a user opens the dashboard/refreshes a new search is not executed. Refer to Splunk Documentation on Performance/Access considerations for using Reports in Dashboard
I've already tried it with a savedsearch, but either nothing happened or the error "Could not find variable in the argument map" occured.
I've tried several opportunities like:
|savedsearch testsavedsearch |where ValueinReport=$TokenName$
|savedsearch testsavedsearch |search ValueinReport=$TokenName$
|savedsearch testsavedsearch ValueinReport=$Token_Name$
Furthermore I've tried it with a report, where the token is also implemented:
index=main sourcetype=test ValueinReport=$Token_Name$ |timechart ....