Dashboards & Visualizations

Dashboards - - Common subsearch query

pahilw
Explorer

Question on common subsearch query on dashboard - I have 6 panels on my dashboard and all the panels use same subsearch query to get list of hosts. Is there a way to execute this query only once and provide it as input to panels? List of hosts get updated every 5-10 minutes so they need to be dynamically retrieved.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

pahilw
Explorer

works great.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...