XML Base search is not working

[av_]

I'm trying to run a base search but it is throwing me an error. Reason being I have two search tags inside a panel. 
EG:

Base search:

<search id="basesearch">
<query>index=main source=xyz
</query>
<earliest>$EarliestTime$</earliest>
<latest>$LatestsTime$</latest>
</search>

Panel search:

<chart depends="$abc$">
<title>Chart1</title>
<search>
<done>
<eval abc="computer1"</eval>
</done>
<search base="basesearch">
<query>
|search host="INFO" OR host="ERROR" panel=$panel1$
|timechart span=$TimeSpan$m count by panel usenull=f useother=f
| eventstats sum("host") as _host</query>
</search>
<earliest>$InputTimeRange.earliest$</earliest>
<latest>$InputTimeRange.latest$</latest>
</search>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"host":0xFFFF00}</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">progressbar</option>
</chart>

Warning msg : Node <search> is not allowed here

Done section is required in the panel so I cannot remove it. 
Is there a way to use a base search this way?

[PickleRick]

You have a search element within a search element.

If you see here https://docs.splunk.com/Documentation/Splunk/9.2.0/Viz/PanelreferenceforSimplifiedXML#search search element is not allowed as a child of a search element.

[av_]

You're right @ITWhisperer, I can't change the time from what was used in the base search which brings me to my second question. How can I add a drilldown to the same panel with a different timestamp?
I want to expand the bar chart for a particular time to a drilldown containing more detailed information for that selected time frame.

[gcusello]

Hi @av_ ,

if you don't have a streming command (as stats or timechart) in the base search, you must specify, at the end of the base search, all the fields that you need to use in the panels, in your case:

index=main source=xyz
| fields host panel _time

Ciao.

Giuseppe 

[ITWhisperer]

Try it like this: (I don't think you can change the time from what was used in the base search, and there should only be one level of <search></search>)

<chart depends="$abc$">
<title>Chart1</title>
<search base="basesearch">
<query>
|search host="INFO" OR host="ERROR" panel=$panel1$
|timechart span=$TimeSpan$m count by panel usenull=f useother=f
| eventstats sum("host") as _host</query>
<done>
<eval abc="computer1"</eval>
</done>
</search>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"host":0xFFFF00}</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">progressbar</option>
</chart>