Dashboards & Visualizations

Is there a way to use a report as a base search for subsequent chain searches?

Allene139
Explorer

I am creating a dashboard for my team. So far, I've been able to implement chain searches by modifying the source code. However, they are based on a live base search. My goal is to power the base searches off of a report instead of a live search. Is that possible?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@Allene139 

Yes, just use this

<search ref="report_name">
...
</search>

See the documentation here

https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/PanelreferenceforSimplifiedXML#search

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@Allene139 

Yes, just use this

<search ref="report_name">
...
</search>

See the documentation here

https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/PanelreferenceforSimplifiedXML#search

 

Allene139
Explorer

Thank you very much

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...