dashboard studio

[verd4nd1]

Hi folks,

I have the following question about a dashboard built within Dashboard Studio. My dashboard consists of several filter elements, filling search tokens, and some panels (9) to visualize the corresponding events. The search queries within the data sources always start with the same repeating structure:

index=index1 field1="$token1$" field2="$token2$" field3="$token3$"

followed by a part of the query that is custom for every data source.

So my aim was to outsource the repeating part of the query into something reusable, so that if changes are necessary (adding or removing some filters), I don't have to change the query in every single data source. Initially, I thought of using a macro, but with parameterization, I gain nothing because every data source still has to be adjusted (new filter -> new parameter).

So my question is: Do I have a thinking error, or is there another way to achieve my goal?

[bowesmana]

Don't create a chained search with no transforming command if your goal is simply to optimise editing of the same search string - base searches are not intended to be used as simply a large internal data store of raw data that other searches use. These will not perform well and also have data size limitations.

A little more convoluted is to do it by having a base search that constructs the search string you want and you can then use the result of that calculated search in your other searches, like this

{
    "title": "Example DS",
    "description": "",
    "inputs": {
        "input_RFDATAAt": {
            "options": {
                "token": "token2"
            },
            "title": "Field 2",
            "type": "input.text"
        },
        "input_gwpzfltt": {
            "options": {
                "token": "token3"
            },
            "title": "Field 3",
            "type": "input.text"
        },
        "input_yn3wY65y": {
            "options": {
                "token": "token1"
            },
            "title": "Field 1",
            "type": "input.text"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {}
                }
            },
            "ds.spl2": {
                "options": {
                    "queryParameters": {}
                }
            }
        },
        "visualizations": {
            "global": {
                "showProgressBar": true
            }
        }
    },
    "visualizations": {
        "viz_LR1HiTkj": {
            "dataSources": {
                "primary": "ds_5kovgazS"
            },
            "description": "This waits for all field filters to be entered then calculates the constructed search",
            "eventHandlers": [
                {
                    "options": {
                        "newTab": false,
                        "type": "auto"
                    },
                    "type": "drilldown.linkToSearch"
                }
            ],
            "options": {
                "showInternalFields": false
            },
            "title": "Background search that calculates base string",
            "type": "splunk.table"
        },
        "viz_ee6deRfB": {
            "dataSources": {
                "primary": "ds_OydjwvQS"
            },
            "description": "This search is the main search using the evaluated string",
            "eventHandlers": [
                {
                    "options": {
                        "newTab": false,
                        "type": "auto"
                    },
                    "type": "drilldown.linkToSearch"
                }
            ],
            "options": {
                "showInternalFields": false
            },
            "title": "Result of search for $search_string_creator:result.search_string$",
            "type": "splunk.table"
        }
    },
    "dataSources": {
        "ds_5kovgazS": {
            "name": "search_string_creator",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval search_string=printf(\"index=%s field1=%s field2=%s field3=%s\", \"index1\", $token1|s$, $token2|s$, $token3|s$)"
            },
            "type": "ds.search"
        },
        "ds_OydjwvQS": {
            "name": "Table search",
            "options": {
                "query": "$search_string_creator:result.search_string$",
                "queryParameters": {
                    "earliest": "-h@h",
                    "latest": "@h",
                    "sampleRatio": 1
                }
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 837,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "input_yn3wY65y",
                        "position": {
                            "h": 82,
                            "w": 198,
                            "x": 0,
                            "y": 0
                        },
                        "type": "input"
                    },
                    {
                        "item": "input_RFDATAAt",
                        "position": {
                            "h": 82,
                            "w": 198,
                            "x": 198,
                            "y": 0
                        },
                        "type": "input"
                    },
                    {
                        "item": "input_gwpzfltt",
                        "position": {
                            "h": 82,
                            "w": 198,
                            "x": 396,
                            "y": 0
                        },
                        "type": "input"
                    },
                    {
                        "item": "viz_LR1HiTkj",
                        "position": {
                            "h": 250,
                            "w": 1440,
                            "x": 0,
                            "y": 82
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_ee6deRfB",
                        "position": {
                            "h": 250,
                            "w": 1440,
                            "x": 0,
                            "y": 332
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    },
    "applicationProperties": {
        "hideEdit": false,
        "hideExport": false
    }
}

The first table search simple waits for all filters to be selected and it then calculates the table field "search_string". After that search completes, you can reference $search_string_creator:result.search_string$ to get the value of the string.

It's a bit of a hack, but it means that all you need to modify is the printf statement to construct your search if you change your filters.

[livehybrid]

Hi @verd4nd1 

Create a standard data source with:

index=index1 field1="$token1$" field2="$token2$" field3="$token3$"

Then create a child search and set the parent as your base search, do this for each custom child search required.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[ITWhisperer]

You can define a datasource, and chained datasource running from the results of the first datasource. This is a bit like base searches in SimpleXML. Note that the first datasource should be a transforming search e.g. containing with a table command