Reporting

How to pass a parameter to a report that uses federated search?

Tommiee
Loves-to-Learn Everything

Hello,

 

I have a report that uses federated search:

index="federated:xxx" filter="Value"
| rest_of_the_search 

I can insert it in my dashboards as follow and it works: 

<search id="base_search_name" ref="report_name"></search>

 

However, I now want to give an argument to this second report:

index="federated:xxx" filter=$token$
| rest_of_the_search 

So that I can call it like this:

<search id="base_search_name2">
<query>| savedsearch "report_name2" token=$dashboard_token$</query>
</search>

 

This does not work. Because probable "savedsearch" does not work with federated search?

https://docs.splunk.com/Documentation/Splunk/9.0.1/Search/Aboutfederatedsearch

 

 

Long story short,

How to pass a parameter to a report that uses federated search

 

 

Thanks in advance,

Tom

 

 

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...