How to refer to a post-process base search from append subsearch queries in a dashboard?

[ishaanshekhar]

I have a base search in my dashboard that refers to a scheduled search:

<search id="Base_Search" ref="Scheduled_Report">
       <query></query>
 </search>

I have another table in the dashboard with multiple rows added through append:
e.g.

 <table>
   <title></title>
   <search base="Base_Search">
       <query> ...query1... | append [ ...query2] | append [ ...query3... ]| append [ ...query4... ] </query>
   </search>
 </table>

I understand that query1 would use the Base_search. However, I also want the append searches 2, 3, and 4 to also refer to the base search.

Is that possible? If yes, could you please let me know how?

Thank you!

[frobinson_splun · Accepted solution]

Hello @ishaanshekhar,
I'm a tech writer here at Splunk and I'd like to help with your question. Currently, chained post-process searches are not supported. However, for setting up non-chained post-process searches, this documentation topic offers some examples:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_examples

I hope that this helps! Please let me know either way. We can continue discussing the dashboard that you're trying to build.

All best,
@frobinson_splunk

[frobinson_splun]

As a follow-up, chained post-process searches are now supported. Please see:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Chained_post-process_example

for an example.

[ishaanshekhar]

Thanks a lot @frobinson ! This is very helpful.