How to use multiple base searches in one search?

[olejor]

I have to base searches defined in my dashboard:

<search id="num1">
    <query>....</query>
</search>
<search id="num2">
    <query>...</query>
</search>

I use these two base searches in multiple charts/stats in each it's way, so I cannot put them together. This lead me to the idea that maybe I could use multiple "bases" in one search?

<search base="num1 num2">
    <query>stats ... </query>
</search>

But this does not seem to work, am I doing something wrong?

[nick405060]

You CAN do this!

https://answers.splunk.com/answers/616340/is-it-possible-to-use-base-search-in-append-sub-se.html

Simply append multiple loadjobs. Also see:

https://answers.splunk.com/answers/738095/dashboard-search-optimization-only-run-searches-wh.html

[somesoni2 · Accepted solution]

The base=... only supports specifying single base search id, so what you're trying to achieve will not work. One workaround would be to have a single base search which merges search for both the base search and use that combined based search in your panel.

<search id="combined">
     <query>..query1..| append [....query2...]</query>
 </search>

 <search base="combined">
     <query>stats ... </query>
 </search>

[nick405060]

I downvoted this post because downvoting because this answer is no longer correct

[ppablo]

Hi @nick405060

As @somesoni2 mentioned, if an answer is no longer currently applicable because there are new capabilities in more recent versions of the product that address it, commenting with links to latest supporting documentation will be more constructive. Or, if you answer the question with an updated solution of your own and commenting to check out your answer works great too.

Downvoting on Answers should be reserved for proposed solutions that are completely against known best practices, or ones that could be potentially harmful to a user's Splunk environment. More on voting etiquette on Answers can be found here.

Thanks for all the answers and help you have been contributing to the community.

[nick405060]

I mean, I agree, you should not downvote an answer that works for some versions but not for others.

However, in this case the answer was not "here's an answer that works for version X" or "you can't do this in version X and below" (in which case downvoting would have been incorrect) but the answer was "there is not a solution to this problem (and here's a tangentially related workaround)", which is now wholly incorrect no matter what logical framework you use. And yes tangentially, the question literally says "multiple base searches" in the title.

I think downvoting solutions that say "sorry, you can't solve this problem" when they are no longer correct is extremely helpful to the community. It's not a slight to the person who posted it (isn't this how all internet forums work? a downvote isn't necessarily a personal slight? it's for the accuracy of communal knowledge?). Otherwise people like me see the answer, assume it's accurate, and stop exploring avenues to fixing the problem because they've been told they can't fix it. Since downvoting doesn't actually remove the answer, the net positive of downvoting is more robust communal knowledge, and the net positive of not downvoting is, well, zero.

Honestly, SA downvoting is so ridiculously policed and also inconsistent with the entire internet. I cannot believe I got hit for this. Just trying to contribute to the community. Why don't you just remove the capability if you don't want people to use it...? I think Splunk would be better suited to, instead of taking the money I pay and using it to police my downvoting, to use that money to fix issues, e.g. the fact that Splunk is a billion-dollar company that cannot put BUTTONS (or single-value checkboxes, mostly) on its SimpleXML dashboards. Or, you know, adding a non-loadjob multiple base search capability.

[somesoni2]

@nick405060, Instead of downvoting, a better action would be to post an answer that works for current version and mention that current accepted answer was only suitable for so and so Splunk versions. The answer is not incorrect. What you do with your loadjob version is basically the same what this answer suggests (appending multiple searches to each other to form one combined base search). The loadjob method also requies that you save all your different base searches as a saved search.

[olejor]

It became a real mess, but it works. Let's hope multiple base's is supported in the future 🙂

[nick405060]

Agreed. I need to do the same thing and the whole appending your base searches into one by hand is messy af. I would think supporting multiple base searches is not hard... literally behind the scenes the capability would similarly just be appending the base searches same but with the result of much more readable code. Ugh.

[sundareshr]

I don't believe you can use multiple base searches for post processing in a single dashboard.