Reporting

How to pass a parameter to a report that uses federated search?

Tommiee
Loves-to-Learn Everything

Hello,

 

I have a report that uses federated search:

index="federated:xxx" filter="Value"
| rest_of_the_search 

I can insert it in my dashboards as follow and it works: 

<search id="base_search_name" ref="report_name"></search>

 

However, I now want to give an argument to this second report:

index="federated:xxx" filter=$token$
| rest_of_the_search 

So that I can call it like this:

<search id="base_search_name2">
<query>| savedsearch "report_name2" token=$dashboard_token$</query>
</search>

 

This does not work. Because probable "savedsearch" does not work with federated search?

https://docs.splunk.com/Documentation/Splunk/9.0.1/Search/Aboutfederatedsearch

 

 

Long story short,

How to pass a parameter to a report that uses federated search

 

 

Thanks in advance,

Tom

 

 

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...