Is it possible to use id and base in the same search in Simple XML?

[jocobknight]

Hello,

Is there an available post-processing method to use a base search and produce a secondary search id? I'm putting two Gantt charts in one dashboard and it's easiest to just use a base search in the data-options. What I'm looking to do is essentially this:

<search base="base1" id="base2">

I know I could just have two base searches run independently, but I'm also shooting for high performance for the client, so it would be ideal to run one search and then query off that result for later panels. I could also see me using this method for other performance enhancements later.

[yannK · Accepted solution]

yes it's called " chained post process"

see http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Examples_2

[jocobknight]

Just to add to this. I've been doing some testing and while my example doesn't seem to raise any warning flags syntactically, it produces some odd behavior. When using a panel with "base2," it produces a proper search string, but an improper result. For instance, say base1 is a table with four fields, and base2 tables out only one of those fields. If I put a panel on using base2, then it will still show me 4 fields from base1. But, if I open that panel in search, it has the full search including the base2 pipes. I'll continue to massage this method to see if I can get it to work with the Gantt charts...

[jocobknight]

It does work for the Gantt charts! Thank you Alex Iribarren for making such adaptive coding! I guess I'll keep the question open to see if anyone knows how to get it working for standard Splunk panels. I'd like to have this method in my utility belt for the future it possible...

[sundareshr]

See @martin_mueller explanation here.

https://answers.splunk.com/answers/263107/postprocess-chaining-possible-in-simple-xml.html

[jocobknight]

Thanks for the reply @sundareshr! I guess if it's not supported then I won't use for leveling up my optimizations. It does work for html panels though (with some odd restrictions - and append [subsearch] in my secondary base gets ignored, but the rest functions correctly). It might be an nice trick though. Maybe as a way to hide messages for other power users (I know, that's a dumb idea).