Splunk Search

Annotation based on Existing Value (to avoid duplicate search)

lennys26
Communicator

On an existing dashboard I have a rather complex query that generates a timechart on which I am looking to use annotations to highlight threshold breaches.

Is there any way to avoid having to run the same query twice (once to create the initial chart, and a second time for the annotations).

Oh -- [I think I have may be answering my own question,] is the answer here going to be to use a base search?

Thanks.

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, a base search will be a good start.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, a base search will be a good start.

---
If this reply helps you, Karma would be appreciated.

lennys26
Communicator

@richgalloway  - Thanks. I tend to shy away from base searches for some reason.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...