Dashboards & Visualizations

splunk dashboard basequery with datamodel

imurpalvicky
Engager

Hi Team,
I am trying to create a dashboard with base query taking values from data model . But it is not yielding any results(Only when i have that in basequery). Seems the base query syntax is wrong , since it starts with pipeline (|) . Any help on where i am going wrong.Thanks in advance

search id="test_basequery"
query | datamodel test_stats_data_model test_stats_data_set search
/query

0 Karma

lakshman239
Influencer

I have a dashboard with dropdown [ having values for sourcetype] and then base search

|datamodel Authentication Authentication search | search sourcetype=$st$

this should then take the sourcetype and pull the relevant data from datamodel. would this help?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...