Dashboards & Visualizations

XML Base search is not working

av_
Path Finder

I'm trying to run a base search but it is throwing me an error. Reason being I have two search tags inside a panel. 
EG:

Base search:

<search id="basesearch">
<query>index=main source=xyz
</query>
<earliest>$EarliestTime$</earliest>
<latest>$LatestsTime$</latest>
</search>

Panel search:

<chart depends="$abc$">
<title>Chart1</title>
<search>
<done>
<eval abc="computer1"</eval>
</done>
<search base="basesearch">
<query>
|search host="INFO" OR host="ERROR" panel=$panel1$
|timechart span=$TimeSpan$m count by panel usenull=f useother=f
| eventstats sum("host") as _host</query>
</search>
<earliest>$InputTimeRange.earliest$</earliest>
<latest>$InputTimeRange.latest$</latest>
</search>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"host":0xFFFF00}</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">progressbar</option>
</chart>

Warning msgNode <search> is not allowed here

Done section is required in the panel so I cannot remove it. 
Is there a way to use a base search this way?

 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have a search element within a search element.

If you see here https://docs.splunk.com/Documentation/Splunk/9.2.0/Viz/PanelreferenceforSimplifiedXML#search search element is not allowed as a child of a search element.

0 Karma

av_
Path Finder

You're right @ITWhispererI can't change the time from what was used in the base search which brings me to my second question. How can I add a drilldown to the same panel with a different timestamp?
I want to expand the bar chart for a particular time to a drilldown containing more detailed information for that selected time frame.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @av_ ,

if you don't have a streming command (as stats or timechart) in the base search, you must specify, at the end of the base search, all the fields that you need to use in the panels, in your case:

index=main source=xyz
| fields host panel _time

Ciao.

Giuseppe 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this: (I don't think you can change the time from what was used in the base search, and there should only be one level of <search></search>)

<chart depends="$abc$">
<title>Chart1</title>
<search base="basesearch">
<query>
|search host="INFO" OR host="ERROR" panel=$panel1$
|timechart span=$TimeSpan$m count by panel usenull=f useother=f
| eventstats sum("host") as _host</query>
<done>
<eval abc="computer1"</eval>
</done>
</search>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"host":0xFFFF00}</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">progressbar</option>
</chart>
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...