Splunk Search

Can anyone explain what is a Splunk Base Search?

splgeek
Explorer

Hello Splunkers

Can anyone explain in simple terms what is a Splunk Base Search?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The term has two meanings. The first refers to the part of an SPL query prior to the first '|'.

The second is used in dashboards and refers to a search query the results of which are used in the later post-processed searches. See "Post-process searches" in http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The term has two meanings. The first refers to the part of an SPL query prior to the first '|'.

The second is used in dashboards and refers to a search query the results of which are used in the later post-processed searches. See "Post-process searches" in http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches

---
If this reply helps you, Karma would be appreciated.

splgeek
Explorer

Thank you guys

0 Karma

hjauch_splunk
Splunk Employee
Splunk Employee

In the context of IT Service Intelligence, KPI base searches can be used to share a search definition across multiple KPIs that use the same data source. For example, you may have several KPIs that are based on the same sets of source events, but are measuring on different fields. You can create base searches to consolidate these KPIs, reduce search load, and improve search performance.

For info on KPI base searches, see http://docs.splunk.com/Documentation/ITSI/2.4.0/Configure/HowtocreateKPIsearches#Create_KPI_base_sea...

0 Karma

somesoni2
Revered Legend

Extending answer from Richard, the first part of the search is the base search. Consider this search:

index=_internal sourcetype=splunkd | stats count by source

The part before first pipe index=_internal sourcetype=splunkd is the base search. While in below search:

| tstats count WHERE index=_internal sourcetype=splunkd by source | table sourcetype

The first portion of the search | tstats count WHERE index=_internal sourcetype=splunkd by source is the base search.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...