Splunk Search

How to create a dashboard : timechart with base search and events limit?

asafd
Explorer

Hi,

I have multiple panels that need to run timecharts like these:

  1. something | table _time,A,B</query> | search A="1"| timechart B
  2. something | table _time,A,B</query> | search A="2"| timechart B
  3. something | table _time,A,B</query> | search A="3"| timechart B

I want to optimize my dashboard for performance by using a base search, so I tried this:

<search id="base>
<query> something | table _time,A,B</query>
</search>
....
<panel>
<chart>
<search base="base">
<query>search A="1"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
  <search base="base">
<query>search A="2"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
<search base="base">
<query>search A="3"|timechart count by B</query>
</search>
</chart>
</panel>

It works great on short times (24h) but with wider ranges (30 days) I lose events because of the base search limit (probably the default, 500,000).

Is there a way I can use base search for this?

I'm using Splunk Enterprise version 8.1.3.

 

Labels (2)
0 Karma

asafd
Explorer

I tried to create a saved search (time range: -1y - now) and use it like this:

<search id="base ref="saved_search">
  <earliest>$sinceTime.earliest$</earliest>
<latest>$sinceTime.latest$</latest>
</search>

but it doesn't seem to solve the events limit issue when i use past 30 days. 

Also I would expect the chart to load immediately (since the base search is already saved), but it takes time to load.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...