Splunk Search

How to create root search and base search in dashboard?

Sekhar
Explorer

We have created base serach query but I required to created root search base on that .

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

what do you mean with "root search"?

you can create a base search (eventually more than one) in the top of your dashboard and call it in each panel, only one for each panel.

Could you share your code (please using the Add/Insert Code panel) and better describe what you need?

Ciao.

Giuseppe

0 Karma

Sekhar
Explorer

<search ID=" start event">

<Query> index=x source= xtype application=xapps<\quer>

 

I am using base query in plannel 

Panael

Serach base=" start event"

Query  | status count   working fine for panel 

 

We have multiple base query index ,source, application same so i need to create one root search for comman search.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

to have the maximum advantage from a base search you should use a streming command (as stats, or chart, etc...) in the base search itself.

If it isn't possible, as in your case, you have to explicit the fields to use in the panels at the end of the base search using the fields command:

<search ID=" start event">
<Query> 
   index=x source= xtype application=xapps
   | fields <fields used in the panels>
<\Query>

I'll be more detailed if you could share your dashboard code and, please, put it in the using the Add/Insert Code panel.

Then don't use spaces in fields and base_search names.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...