Dashboards & Visualizations

Dashboards - - Common subsearch query

pahilw
Explorer

Question on common subsearch query on dashboard - I have 6 panels on my dashboard and all the panels use same subsearch query to get list of hosts. Is there a way to execute this query only once and provide it as input to panels? List of hosts get updated every 5-10 minutes so they need to be dynamically retrieved.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for post-process searches: http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/Savedsearches#Post-process_searches

A base search runs once, returns a datacube-style preliminary result, post-processing searches turn the datacube into what each panel actually needs.

View solution in original post

pahilw
Explorer

works great.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!