Dashboards & Visualizations

use of | savedsearch with custom dashboards ?

zscgeek
Path Finder

Is there any way to use the |savedsearch syntax with realtime searches?

Right now I have the view defined below. If I select one of the realtime options from the time input I get the following error:

A real-time search must start with the search command

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>

  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>|savedsearch "HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

If I get rid of |savedsearch and replace it with the underlying search terms it works ok.

0 Karma
1 Solution

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

View solution in original post

0 Karma

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You might consider using a macro rather than a saved search here.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...