Getting Data In

Is it possible to have scheduled saved search using summary indexing and dynamic token depending on user query?

splunkreal
Motivator

Hello,
one user wants to convert dashboard with token to summary indexing dashboard.
We are using | sistats or similar, scheduling data collection each minute or other frequency.

However user has token input to filter later dynamically search results.

Is it possible to have scheduled saved search using summary indexing and dynamic token depending on user query?

May I remove the filter and grab all results then filter in the final summary indexing dashboard?

Thanks for your help.

* If this helps, please upvote or accept solution if it solved *
Labels (1)
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...