Dashboards & Visualizations

scheduled reports in dashboards

nikhilnsr1998
Explorer

While creating a dashboard i used scheduled reports to present visuals.

The problem is, the reports have overlapping queries as they the dashboard was  originally implemented with base searches.

How can I use scheduled reports as base searches?

or,

How can i use data from the same scheduled report and create different visuals in the same Dashboard?

Thanks and Regards.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Yes, you can use reports as base searches like this

<search id="base_name" ref="report_name"/></search>
...
<search base="base_name">
...

See the docs here

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#search

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Yes, you can use reports as base searches like this

<search id="base_name" ref="report_name"/></search>
...
<search base="base_name">
...

See the docs here

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#search

 

codebuilder
Influencer

You can use either "base" or "loadjob" to pull search results into your dashboard. The loadjob call works really well with the caveat that if the saved search has not executed successfully you wont get results.

There is a good discussion on this topic with examples here:
https://community.splunk.com/t5/Reporting/Using-a-Scheduled-Saved-Search-as-a-base-search-in-dashboa...

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...