November 2018
Beginner
298 pages
7h 51m
English
If you have a dashboard running several searches that are similar, you can save search resources (and time) by creating a base search (also known as a Global search) for the dashboard, and configuring the applicable panels to use a post-process search to modify the results of the base search. The following code shows a simple example—and note that you can use HTML-format comments in Simple XML:
<! -- Base search --><dashboard> # (or <form>)
<label>Dashboard with post-process search</label>
<search id="baseSearch">
<query>
index=_internal source=*splunkd.log | stats count by component, log_level
</query>
</search>... (tags below compressed to save space)<!-- post-process search # 1 --> <row> <panel> <chart> ...Read now
Unlock full access