I have a base search in my dashboard that refers to a scheduled search:
<search id="Base_Search" ref="Scheduled_Report">
<query></query>
</search>
I have another table in the dashboard with multiple rows added through append:
e.g.
<table>
<title></title>
<search base="Base_Search">
<query> ...query1... | append [ ...query2] | append [ ...query3... ]| append [ ...query4... ] </query>
</search>
</table>
I understand that query1 would use the Base_search. However, I also want the append searches 2, 3, and 4 to also refer to the base search.
Is that possible? If yes, could you please let me know how?
Thank you!
Hello @ishaanshekhar,
I'm a tech writer here at Splunk and I'd like to help with your question. Currently, chained post-process searches are not supported. However, for setting up non-chained post-process searches, this documentation topic offers some examples:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_examples
I hope that this helps! Please let me know either way. We can continue discussing the dashboard that you're trying to build.
All best,
@frobinson_splunk
Hello @ishaanshekhar,
I'm a tech writer here at Splunk and I'd like to help with your question. Currently, chained post-process searches are not supported. However, for setting up non-chained post-process searches, this documentation topic offers some examples:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_examples
I hope that this helps! Please let me know either way. We can continue discussing the dashboard that you're trying to build.
All best,
@frobinson_splunk
As a follow-up, chained post-process searches are now supported. Please see:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Chained_post-process_example
for an example.
Thanks a lot @frobinson ! This is very helpful.