Splunk Search

How to use multiple saved searches for a single table

AKG1_old1
Builder

Hi,
We are using a table in our dashboard and its output is based on multiple saved search.
How can I run multiple saved search in parallel and combined its result in a single table?

I have created below search which works fine but I am not be able to use in my dashboard.

| makeresults 
| eval ALERT="KPI_MXTIMING_MEM_LIVEBOOK_SESSION_FUNCTION" 
| append 
    [ makeresults 
    | eval ALERT="KPI_MXTIMING_LIVEBOOK_SESSION_CC_1MIN_FUNCTION"] 
| table ALERT 
| map  search="| savedsearch "$ALERT$" host_token=MX_Archival41 earliest_time_token=-10d"

When I add this search in the dashboard it says waiting for input. Reason is $ALERT$ in search which takes results from the first part of the search but on dashboard, even the first part won't run if there is any unassigned token present in search.

If I run this search directly it's working but not on the dashboard.

alt text

I am using mapping instead of append as there could be 10 saved searches and it will take longer to execute.
So I'm looking for a solution to run these saved search in parallel and produce results in a single table.

0 Karma

somesoni2
Revered Legend

Try this

| makeresults 
 | eval ALERT="KPI_MXTIMING_MEM_LIVEBOOK_SESSION_FUNCTION" 
 | append 
     [ makeresults 
     | eval ALERT="KPI_MXTIMING_LIVEBOOK_SESSION_CC_1MIN_FUNCTION"] 
 | table ALERT 
 | map  search="| savedsearch "$$ALERT$$" host_token=MX_Archival41 earliest_time_token=-10d"

AKG1_old1
Builder

Brilliant !! @somesoni2 : Thank you. please update this as answer.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...