I have 4 charts in a dashboard, ABCD|E , ABCD|F, ABCD|G, and ABCD|H. ABCD being the search condition.
The only different in each chart is which value is being charted (E, F, G or H).
Rather than running 4 different searches for the same data and processing them. Is there a ways to just generate a report with ABCD criteria, then use the result of that report to generate my Chart E, F, G, & H?
I'm trying to figure out how to save search time, and system resource.
Hi @dling,
You might want to consider creating a global search (ABCD) and then using simple XML to access that global search and then modify it with different post-process searches in your various charts. Here is some documentation about this:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches
Hope this helps! Let me know if not and we can continue discussing.
Best,
@frobinson_splunk