Splunk Search

How to create a dashboard : timechart with base search and events limit?

asafd
Explorer

Hi,

I have multiple panels that need to run timecharts like these:

  1. something | table _time,A,B</query> | search A="1"| timechart B
  2. something | table _time,A,B</query> | search A="2"| timechart B
  3. something | table _time,A,B</query> | search A="3"| timechart B

I want to optimize my dashboard for performance by using a base search, so I tried this:

<search id="base>
<query> something | table _time,A,B</query>
</search>
....
<panel>
<chart>
<search base="base">
<query>search A="1"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
  <search base="base">
<query>search A="2"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
<search base="base">
<query>search A="3"|timechart count by B</query>
</search>
</chart>
</panel>

It works great on short times (24h) but with wider ranges (30 days) I lose events because of the base search limit (probably the default, 500,000).

Is there a way I can use base search for this?

I'm using Splunk Enterprise version 8.1.3.

 

Labels (2)
0 Karma

asafd
Explorer

I tried to create a saved search (time range: -1y - now) and use it like this:

<search id="base ref="saved_search">
  <earliest>$sinceTime.earliest$</earliest>
<latest>$sinceTime.latest$</latest>
</search>

but it doesn't seem to solve the events limit issue when i use past 30 days. 

Also I would expect the chart to load immediately (since the base search is already saved), but it takes time to load.

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...