Splunk Search

How to create a dashboard with one search that can produce results for both today and yesterday?

Isiegniel
New Member

Hello,

I want to create a dashboard with 2 searches. Search A should show a search result from today.
Search B should show a search Result from yesterday.

Is there a way to give the results from search A to B so that B doesn't need to search again?

Tags (3)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Yes it's called post processing

"If your dashboard contains panels that run similar searches, you can save search resources by creating a base search for the dashboard. Panels in the dashboard can use a post-process search to further modify the results of a base search. The base search can be a global search for the dashboard or any other search within the dashboard."

http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_searches

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Yes it's called post processing

"If your dashboard contains panels that run similar searches, you can save search resources by creating a base search for the dashboard. Panels in the dashboard can use a post-process search to further modify the results of a base search. The base search can be a global search for the dashboard or any other search within the dashboard."

http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_searches

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...