Splunk Search

How to create root search and base search in dashboard?

Sekhar
Explorer

We have created base serach query but I required to created root search base on that .

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

what do you mean with "root search"?

you can create a base search (eventually more than one) in the top of your dashboard and call it in each panel, only one for each panel.

Could you share your code (please using the Add/Insert Code panel) and better describe what you need?

Ciao.

Giuseppe

0 Karma

Sekhar
Explorer

<search ID=" start event">

<Query> index=x source= xtype application=xapps<\quer>

 

I am using base query in plannel 

Panael

Serach base=" start event"

Query  | status count   working fine for panel 

 

We have multiple base query index ,source, application same so i need to create one root search for comman search.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

to have the maximum advantage from a base search you should use a streming command (as stats, or chart, etc...) in the base search itself.

If it isn't possible, as in your case, you have to explicit the fields to use in the panels at the end of the base search using the fields command:

<search ID=" start event">
<Query> 
   index=x source= xtype application=xapps
   | fields <fields used in the panels>
<\Query>

I'll be more detailed if you could share your dashboard code and, please, put it in the using the Add/Insert Code panel.

Then don't use spaces in fields and base_search names.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...