Dashboards & Visualizations

use of | savedsearch with custom dashboards ?

zscgeek
Path Finder

Is there any way to use the |savedsearch syntax with realtime searches?

Right now I have the view defined below. If I select one of the realtime options from the time input I get the following error:

A real-time search must start with the search command

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>

  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>|savedsearch "HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

If I get rid of |savedsearch and replace it with the underlying search terms it works ok.

0 Karma
1 Solution

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

View solution in original post

0 Karma

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You might consider using a macro rather than a saved search here.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...