Multiple searchTemplate and searchPostProcess to populate Dashboard Panels

[hogan24]

I'm trying to create a dashboard with 9 panels. I'm fairly certain that I could, if possible, use 2 base searches to populate all 9 of my panels. However, it seems as though only one 'searchTemplate' can be used as a base search. Therefore, I'm using 1 base search to populate 4 of my panels and have to create 5 other stand-alone searches for my other 5 panels.

Using the simple XML structure, is it possible to have multiple "searchTemplates" that act as base search to populate multiple additional panels? If so, how would that be done?

Here's what I'm doing so far.... (i've removed all the extra 'option' values from the charts.) I have one 'searchTemplate' populating the data for the 4 'searchPostProcess' panels below. And then 5 other stand-alone searches. Is there a way I can have additional 'searchTemplates' and avoid doing so many stand-alone searches?

Any assistance/thoughts would be appreciated. Thanks.

<form>
  <label>DashboardTitle</label>
  <searchTemplate>source="dbmon-tail://ProdTxRpting/EligAAA" 
                  | lookup CLIENT_LOOKUP CLIENTID as submitter_id OUTPUT MNEMONIC as Mnemonic 
                  | search Mnemonic=$Mnemonic$ 
                  | stats count by realtime_db, Mnemonic, aaa_cd</searchTemplate>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <label>Select Date Range:</label>
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
    <input type="text" token="Mnemonic">
      <label>Enter a Mnemonic:</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <single>
      <searchString>source="dbmon-tail://ProdTxRpting/EligAAA" realtime_db=1 
                    | lookup CLIENT_LOOKUP CLIENTID as submitter_id OUTPUT MNEMONIC as Mnemonic 
                    | search Mnemonic=$Mnemonic$ 
                    | stats dc(elig_detail_id) as TXs 
                    | eval TXs = tostring(TXs, "commas")</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="underLabel">IBM TXs with at least 1 AAA</option>
      <option name="linkView">search</option>
    </single>
    <single>
      <searchString>source="dbmon-tail://ProdTxRpting/EligAAA" realtime_db=0 
                    | lookup CLIENT_LOOKUP CLIENTID as submitter_id OUTPUT MNEMONIC as Mnemonic 
                    | search Mnemonic=$Mnemonic$ 
                    | stats dc(elig_detail_id) as TXs 
                    | eval TXs = tostring(TXs, "commas")</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="underLabel">JCAPS TXS with at least 1 AAA</option>
      <option name="linkView">search</option>
    </single>
  </row>
  <row grouping="2,1">
    <single>
      <searchString>source="dbmon-tail://ProdTxRpting/EligDetailIBM" 
                    | lookup CLIENT_LOOKUP CLIENTID as submitter_id OUTPUT MNEMONIC as Mnemonic 
                    | search Mnemonic=$Mnemonic$ 
                    | chart dc(trxn_detail_group_id) as HubReceivedTXs 
                    | eval HubReceivedTXs = tostring(HubReceivedTXs, "commas")</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
    </single>
    <single>
      <searchString>source="dbmon-tail://ProdTxRpting/EligDetailIBM" 
                    | lookup CLIENT_LOOKUP CLIENTID as submitter_id OUTPUT MNEMONIC as Mnemonic 
                    | search Mnemonic=$Mnemonic$ 
                    | stats dc(trxn_detail_group_id) as HubReceivedTXs count 
                    | eval NewField1=count-HubReceivedTXs 
                    | eval NewField2 = tostring(NewField1, "commas") 
                    | table NewField2</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
    </single>
    <single>
      <searchString>source="dbmon-tail://ProdTxRpting/EligDetailJCAPS" 
                    | lookup CLIENT_LOOKUP CLIENTID as submitter_id OUTPUT MNEMONIC as Mnemonic 
                    | search Mnemonic=$Mnemonic$ 
                    | chart count as HubReceivedTXs 
                    | eval HubReceivedTXs = tostring(HubReceivedTXs, "commas")</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
    </single>
  </row>
  <row>
    <chart>
      <title>IBM</title>
      <searchPostProcess>| where realtime_db=1 
                         | chart sum(count) as Count by aaa_cd 
                         | sort -Count</searchPostProcess>
    </chart>
    <chart>
      <title>JCAPS</title>
      <searchPostProcess>| where realtime_db=0 
                         | chart sum(count) as Count by aaa_cd 
                         | sort -Count</searchPostProcess>
    </chart>
  </row>
  <row>
    <chart>
      <title>IBM</title>
      <searchPostProcess>| where realtime_db=1 
                         | chart sum(count) as Count by Mnemonic 
                         | sort -Count 
                         | head 10</searchPostProcess>
    </chart>
    <chart>
      <title>JCAPS</title>
      <searchPostProcess>| where realtime_db=0 
                         | chart sum(count) as Count by Mnemonic 
                         | sort -Count 
                         | head 10</searchPostProcess>
    </chart>
  </row>
</form>

[dmillis · Accepted solution]

Version 6.2 added the ability to have multiple base searches.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/PanelreferenceforSimplifiedXML#Search_element

[norbert_hamel]

Hi,

you could turn your dashboard to HTML, where you can use multiple base searches 🙂

Cheers
Norbert