Splunk Search
Highlighted

Share a search for multiple widgets in a Dashboard

Engager

Hi.

I want to create a Dashboard containing several widgets that mainly, are views of the same set of information regarding activity of users in a system. The widgets will show the information about activity but splitted by different fields, summarized by different criteria or just grouped in many ways.

Basically I want to reuse the same initial search and let every widget add specific constraints to the search or add stats, chart or formatting commands.

Is that possible?

*I'm using Splunk 6.1

Tags (2)
0 Karma
Highlighted

Re: Share a search for multiple widgets in a Dashboard

SplunkTrust
SplunkTrust

You're looking for the <searchPostProcess> tag. Grab the Splunk 6 Dashboard Examples app from http://apps.splunk.com/app/1603/ and open the example view Post Process Search to get started.

View solution in original post

Highlighted

Re: Share a search for multiple widgets in a Dashboard

Engager

Thank you, that was what I was looking for!

Another quick question, Is it possible to set a saved search as the template search for a dashboard? As saved searches could be accelerated, it could increase overall performance if the dashboard if its base search is already tuned. Is there a way to make this possible?

Thanks for your help

Arturo

0 Karma
Highlighted

Re: Share a search for multiple widgets in a Dashboard

SplunkTrust
SplunkTrust

I don't think so, considering the <searchTemplate> is meant to be used for $foo$ token substitution.

However, you can make search acceleration work without a maintenance nightmare by using macros. Place the search in a macro, and use that in both a saved accelerated search and the dashboard(s).

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.