Dashboards & Visualizations

use of | savedsearch with custom dashboards ?

zscgeek
Path Finder

Is there any way to use the |savedsearch syntax with realtime searches?

Right now I have the view defined below. If I select one of the realtime options from the time input I get the following error:

A real-time search must start with the search command

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>

  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>|savedsearch "HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

If I get rid of |savedsearch and replace it with the underlying search terms it works ok.

0 Karma
1 Solution

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

View solution in original post

0 Karma

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You might consider using a macro rather than a saved search here.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...