How to Use Splunk Base Searches in Classic XML Dashboard
Why Base Searches? Even when constructing a simple dashboard, you might have multiple panels that independently run their own searches within the dashboard. Splunk executes these searches separately, retrieves the results, and then displays the visualizations. This process could potentially cause the dashboard to take longer to load, as each panel completes its search individually. If these panels are based on the same initial data, utilizing a base search becomes advantageous. With a base search, the search runs once when the dashboard loads, passing its results to the panels. The panels then carry out post-processing before presenting the visualizations. ...