Splunk Search

timechart span in saved search

aaronkorn
Splunk Employee
Splunk Employee

Is there a way to pass a timechart span variable to a saved search being called from a drop down? Is there a way to pass it strictly through the xml?

0 Karma

landen99
Motivator

aholzer
Motivator

No. If you are using a saved search you can't pass variables to it.

However, if you convert the saved search to a macro, then call the macro from your xml with a Search module rather than a SavedSearch module you get the behavior that you are looking for.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...