Splunk Search

How to create a dashboard : timechart with base search and events limit?

asafd
Explorer

Hi,

I have multiple panels that need to run timecharts like these:

  1. something | table _time,A,B</query> | search A="1"| timechart B
  2. something | table _time,A,B</query> | search A="2"| timechart B
  3. something | table _time,A,B</query> | search A="3"| timechart B

I want to optimize my dashboard for performance by using a base search, so I tried this:

<search id="base>
<query> something | table _time,A,B</query>
</search>
....
<panel>
<chart>
<search base="base">
<query>search A="1"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
  <search base="base">
<query>search A="2"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
<search base="base">
<query>search A="3"|timechart count by B</query>
</search>
</chart>
</panel>

It works great on short times (24h) but with wider ranges (30 days) I lose events because of the base search limit (probably the default, 500,000).

Is there a way I can use base search for this?

I'm using Splunk Enterprise version 8.1.3.

 

Labels (2)
0 Karma

asafd
Explorer

I tried to create a saved search (time range: -1y - now) and use it like this:

<search id="base ref="saved_search">
  <earliest>$sinceTime.earliest$</earliest>
<latest>$sinceTime.latest$</latest>
</search>

but it doesn't seem to solve the events limit issue when i use past 30 days. 

Also I would expect the chart to load immediately (since the base search is already saved), but it takes time to load.

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...