Dashboards & Visualizations

use of | savedsearch with custom dashboards ?

zscgeek
Path Finder

Is there any way to use the |savedsearch syntax with realtime searches?

Right now I have the view defined below. If I select one of the realtime options from the time input I get the following error:

A real-time search must start with the search command

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>

  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>|savedsearch "HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

If I get rid of |savedsearch and replace it with the underlying search terms it works ok.

0 Karma
1 Solution

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>

View solution in original post

0 Karma

zscgeek
Path Finder

Found the trick, you need to do with the savedsearch=XXX syntax:

<form>
  <label>HTTP Stats</label>
  <fieldset autoRun="true">      
      <input type="time">
          <default>Last 24 hours</default>
      </input>
  </fieldset>
  <row>
      <chart>
          <title>HTTP Fetch Count</title>
          <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate>
          <option name="charting.chart">area</option>
          <option name="charting.AreaChart.stackMode">stacked</option>
      </chart>
  </row>
</form>
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You might consider using a macro rather than a saved search here.

Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...