Reusing panels in multiple dashboards - How to modify a prebuilt panel?

[ashean]

I'd like to reuse dashboard panels across multiple dashboards, and I would ideally be able to maintain the search logic for the panels in one place rather than having the logic duplicated.

I tried to achieve this using prebuilt panels, but I can't work out how to modify an existing prebuilt panel. It seems like once they are created they can't be changed, which defeats the purpose for me.

I also tried to achieve this by using panels based on reports. This also didn't work for me because my panels take inputs from the dashboard (for example, which hosts to search), but it seems like reports need to be based on a static search string.

I'm running Splunk Version 6.2.6

Any ideas?

[tormodbp · Accepted solution]

I believe that what you are looking for is savedsearch, which you kind of touch with your third example.

Saved searches can be created two ways, either through the interface(Settings -> Searches, reports, and alerts -> New) or by editing(or creating) a savedsearch.conf in the apps directory( ..\etc\<app>\local\savedsearch.conf).

To include the variable names in the saved search you have to specify a placeholder variable:

index=test sourcetype=<my-sourcetype> host=$my-variable$ .....

When wanting to use the savedsearch in a panel, specify the search string for the panel like this:

| savedsearch <my-saved-search> my-variable=<my-input-token>

Now you should be able to use the same search string in all the dashboards and only have to edit the main search string one place.

---

Here is an example of a minimal savedsearch.conf for the saved search test:

[test]
description = A minimal test example of savedsearch with variable
search = index=* sourcetype=test | extract pairdelim="; " kvdelim=":"  | search user=$my-variable$

Cheers,

[ashean]

Thanks, that works well. By using saved searches inside prebuilt panels I get both the easy portability and ability to centrally manage the search logic.

[tormodbp]

If you need specialized panels, remember that you can use the saved search as a "base search" and do other more intricate searches "on top" of it. Its is also quite easy to combine several saved searches with append or similar commands.

Glad i could help!

[santosh_sshanbh]

If I want to pass dynamic value to a panel like Panel Title, chart header etc. within the panel then how can I pass the parameters to a prebuilt panel?