Dashboards & Visualizations

use of | savedsearch with custom dashboards ?

zscgeek
Path Finder

Is there any way to use the |savedsearch syntax with realtime searches?

Right now I have the view defined below. If I select one of the realtime options from the time input I get the following error:

A real-time search must start with the search command

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>

  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>|savedsearch "HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

If I get rid of |savedsearch and replace it with the underlying search terms it works ok.

0 Karma
1 Solution

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

View solution in original post

0 Karma

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You might consider using a macro rather than a saved search here.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...