Splunk Search

How to create a dashboard : timechart with base search and events limit?

asafd
Explorer

Hi,

I have multiple panels that need to run timecharts like these:

  1. something | table _time,A,B</query> | search A="1"| timechart B
  2. something | table _time,A,B</query> | search A="2"| timechart B
  3. something | table _time,A,B</query> | search A="3"| timechart B

I want to optimize my dashboard for performance by using a base search, so I tried this:

<search id="base>
<query> something | table _time,A,B</query>
</search>
....
<panel>
<chart>
<search base="base">
<query>search A="1"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
  <search base="base">
<query>search A="2"|timechart count by B</query>
</search>
</chart>
</panel>
...
<panel>
<chart>
<search base="base">
<query>search A="3"|timechart count by B</query>
</search>
</chart>
</panel>

It works great on short times (24h) but with wider ranges (30 days) I lose events because of the base search limit (probably the default, 500,000).

Is there a way I can use base search for this?

I'm using Splunk Enterprise version 8.1.3.

 

Labels (2)
0 Karma

asafd
Explorer

I tried to create a saved search (time range: -1y - now) and use it like this:

<search id="base ref="saved_search">
  <earliest>$sinceTime.earliest$</earliest>
<latest>$sinceTime.latest$</latest>
</search>

but it doesn't seem to solve the events limit issue when i use past 30 days. 

Also I would expect the chart to load immediately (since the base search is already saved), but it takes time to load.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...