This widget could not be displayed.
  • ">Apps & Add-ons
  • Dashboards & Visualizations

    scheduled reports in dashboards

    nikhilnsr1998
    Explorer

    While creating a dashboard i used scheduled reports to present visuals.

    The problem is, the reports have overlapping queries as they the dashboard was  originally implemented with base searches.

    How can I use scheduled reports as base searches?

    or,

    How can i use data from the same scheduled report and create different visuals in the same Dashboard?

    Thanks and Regards.

    Labels (1)
    0 Karma
    1 Solution

    bowesmana
    SplunkTrust
    SplunkTrust

    Yes, you can use reports as base searches like this

    <search id="base_name" ref="report_name"/></search>
    ...
    <search base="base_name">
    ...

    See the docs here

    https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#search

     

    View solution in original post

    bowesmana
    SplunkTrust
    SplunkTrust

    Yes, you can use reports as base searches like this

    <search id="base_name" ref="report_name"/></search>
    ...
    <search base="base_name">
    ...

    See the docs here

    https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#search

     

    codebuilder
    Influencer

    You can use either "base" or "loadjob" to pull search results into your dashboard. The loadjob call works really well with the caveat that if the saved search has not executed successfully you wont get results.

    There is a good discussion on this topic with examples here:
    https://community.splunk.com/t5/Reporting/Using-a-Scheduled-Saved-Search-as-a-base-search-in-dashboa...

    ----
    An upvote would be appreciated and Accept Solution if it helps!
    0 Karma
    Get Updates on the Splunk Community!

    Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

    WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

    Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

    Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

    Enterprise Security Content Update (ESCU) | New Releases

    In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...