How to pull a field from a saved report into a dashboard and display only one of the fields in a panel?

[charliedgz]

Is there a way to pull a field from a saved report into a dashboard and display only one of the fields in a panel? For instance, I have a saved search for the past 4 hours. I have 3 fields: total, avg, and valid. Let's say the numbers are 7009, 12, and 6576 respectively for example. I am trying to have different panels: One showing a gauge with the totals, one showing the average from the report, and one showing the valid number. Is there a way to pull the total from the report for one panel and avg from the report?

[somesoni2]

You would've to use the ref feature of the search element in simple xml to reference a scheduled saved search. This it'll load the last run's results to dashboard panel, if one exists, or rerun the scheduled search. See more details with example here.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Reference_a_search_from_a_report

<search ref ="[name]">
....
References the report.

[cmerriman]

you could use the savedsearch command followed by fields

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Savedsearch

|savedsearch searchname|fields total

[charliedgz]

Ok, I tried doing this, but it keeps rerunning the search ( in my case 35 million events), even if I used a fix time range. I just want to abstract, say the 7009 without having to rerun the search.

[cmerriman]

sorry. try loadjob
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Loadjob

|loadjob savedsearch="charliedgz:search:searchname"