How to build a dashboard with different input types to generate the results of a report?

[qxu5715]

Hello Community,

I'm sorry if this question has already been asked, but I'm still a newbie in Splunk so please be gentle with me 🙂
In this case, u can just link the relevant question/answer.

I want to build a Dashboard with different Input types, that is generating the results of a report. I already know, that this is quite simple with an inline search, but I want to use the Dashboard explicitly with a report/savedsearch.

To sum up: I wanna have a Dashboard, where u can use a text input/radio buttons etc. to let the report know, what it has to search for.

The idea is that I wanna build a couple of Reports that are implemented in a few different Dashboards. If I should change sth. in one of those reports, the changes shall affect the Dashboards as well, so that I don't have to make all these changes for every single Dashboard.

I hope my problem gets clear.

Thanks and Regards

[niketn]

@qxu5715, you can refer to following documentation to add a Saved Search (Report) as a panel in Dashboard.

Another option for you would be to use Saved Search command for the report inside dashboard <search><query> to get the results. With the savedsearch, you can pipe in your own filters on the existing search.

Ideally you would use Schedule a Saved Search and use that in your Dashboard Panel so that results from previous run of scheduled search is loaded on your dashboard and each time a user opens the dashboard/refreshes a new search is not executed. Refer to Splunk Documentation on Performance/Access considerations for using Reports in Dashboard

[qxu5715]

@niketn,

I've already tried it with a savedsearch, but either nothing happened or the error "Could not find variable in the argument map" occured.
I've tried several opportunities like:

|savedsearch testsavedsearch |where Value_in_Report=$Token_Name$
|savedsearch testsavedsearch |search Value_in_Report=$Token_Name$
|savedsearch testsavedsearch Value_in_Report=$Token_Name$

Furthermore I've tried it with a report, where the token is also implemented:

index=main sourcetype=test Value_in_Report=$Token_Name$ |timechart ....

[skoelpin]

Check out this app. It has tons of examples of how to use tokens. If you do all the exercises, you will vastly increase your dashboarding knowledge

https://splunkbase.splunk.com/app/1603/