Hello,
I have a report that uses federated search:
index="federated:xxx" filter="Value"
| rest_of_the_search
I can insert it in my dashboards as follow and it works:
<search id="base_search_name" ref="report_name"></search>
However, I now want to give an argument to this second report:
index="federated:xxx" filter=$token$
| rest_of_the_search
So that I can call it like this:
<search id="base_search_name2">
<query>| savedsearch "report_name2" token=$dashboard_token$</query>
</search>
This does not work. Because probable "savedsearch" does not work with federated search?
https://docs.splunk.com/Documentation/Splunk/9.0.1/Search/Aboutfederatedsearch
Long story short,
How to pass a parameter to a report that uses federated search
Thanks in advance,
Tom
... View more