I don't have a "saved search" for this query, unfortunately, as I'm not yet able to make an actual "saved search". Just trying to perform some filtering on the results of a search made within the dashboard without reloading the search. I've attempted what I think it is that you're proposing, but the "PostProcessTable"/"PostProcessSearch", which is supposed to load the job from the "BaseTable"/"BaseSearch" is not loading. Instead, it notes reads, "Waiting for input...". I will note that I am on Splunk version 9.0.4, and the switch you pointed out "Access search results or metadata" reads as "Use search results or job status as tokens" in my version of Dashboard Studio. I'm not sure if the issue is: my version of splunk being 9.0.4 the fact that I'm not using a saved search or I'm implementing your proposal incorrectly (very very possible) See example snippet below: "visualizations": { "viz_A2Ecjpct": { "type": "splunk.table", "dataSources": { "primary": "ds_fpJiS8Hp" }, "title": "BaseTable" }, "viz_Ok7Uvz2b": { "type": "splunk.table", "title": "PostProcessTable", "dataSources": { "primary": "ds_q4BDo5Wr" } } }, "dataSources": { "ds_fpJiS8Hp": { "type": "ds.search", "options": { "query": "| makeresults count=5", "queryParameters": { "earliest": "-15m", "latest": "now" }, "enableSmartSources": true }, "name": "BaseSearch" }, "ds_q4BDo5Wr": { "type": "ds.search", "options": { "query": "| loadjob $ds_fpJiS8Hp:job.sid$", "enableSmartSources": true }, "name": "PostProcessSearch" } },
... View more
