Knowledge Management

drilldown on saved search

lostcauz3
Path Finder

I have Four Dashboards Level 1- Level 2- Level 3 - Level 4

Level 1 is a saved search and it has a field called months i want to drilldown using the month value to the next level 2 dashboard which is also a saved search using tok_mon =$click.name2$

How do i Pass a token from a dashboard with saved search to another with saved search
same from level 2 to level 3 and level 3 to level 4

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can't add further SPL to a saved search but you can create it as a base search and base further searches on it, for example something like this

  <search id="main_base" ref="Saved search">
  </search>
  <search base="main_base">
    <query>
      | where month="$chosen_month$"
    </query>
  </search>

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can't add further SPL to a saved search but you can create it as a base search and base further searches on it, for example something like this

  <search id="main_base" ref="Saved search">
  </search>
  <search base="main_base">
    <query>
      | where month="$chosen_month$"
    </query>
  </search>

 

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...