Search alias for a dashboard

[SplnkUse]

Hello!

A dashboard runs a search and I want to create an alert for this. So I replicated the search code to the alert. However, now, if there is a change in the dashboard, my alert will not be updated.

Is there a way to create an alert with a search like: "search dashboard1" or something so that whatever changes happen to the dashboard, they will be fed into my alert?

Thanks!

[shivanshu1593]

You can set a token to capture the job id of your dashboard panel, then make an alert, use the SPL | loadjob <token_name> and save it as a search and put on your dashboard panel. If you already have results in your alert and want the dashboard results to be shown it with, you can always use the append command.

Next time when there's a change in your dashboard, it would get reflected on your search/alert as well.

Hope this helps.

Thank you,

[SplnkUse]

Thanks, could you briefly explain the steps please? What I was doing so far was to visit the dashboard, go to Jobs, check the search code there and create an alert with it. Where do I see the token (or create one) and how do I create a search with it? 

Thanks!

[ITWhisperer]

Can you use a saved search which both the dashboard and alert are based on?

[SplnkUse]

Yes, a saved search would be ideal but what would be its syntax so that it automatically mirrors the search that is triggered when I visit a particular dashboard and reflects any changes in the dashboard underlying code?

Would a SID or token or any other way be ideal? I also see there is a 'Dashboard ID' listed under Apps/Dashboards would that be the right alias? Can you provide the steps please to do that? I.e.:

1) Get the SID/token or alias or anything like that by .....

2) Create a search with the above info by ....

3) Create alert with the above search (I know how to do that)

Thanks!