Reporting

how to filter a saved search

tsmithsplunk
Path Finder

(splunk 4.2) I have a saved search that returns too many categories to be visually clear in a chart. I would like to use the search for an entire dashboard, so I don't want to restrict it. I would like to just display the top 20 results in a chart so the categories will be readable. Can I filter the saved search using the simplified xml?

0 Karma

dturnbull_splun
Splunk Employee
Splunk Employee

On a dashboard with a form, you can use and . Otherwise you can use the savedsearch command to load a saved search, then pipe to head, for example.

0 Karma

tsmithsplunk
Path Finder

You may be assuming I know more than I do. Currently I'm using to access the saved search. I tried many variants but could not get them to work: | savedsearch mysearch; mysearch. Can I combine the and tags?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...