base search
noun
A search on which you can base multiple, similar searches.
- In dashboards, if you have a dashboard running several searches that are similar you can save search resources by creating a base search for the dashboard. Panels in the dashboard use a post-process search to further modify the results of the base search.
- In an SPL2 search module, you can extend or branch a base search into additional searches by adding filters or commands to summarize or transform the search results.
- In the context of IT Service Intelligence (ITSI), use KPI base searches to share a search definition across multiple KPIs that use the same data source. For example, if you have several KPIs based on the same sets of source events, but measuring on different fields, you can create base searches to consolidate these KPIs, reduce search load, and improve search performance.
For more information
In Splunk Enterprise Dashboards and Visualizations:
In the SPL2 Search Manual:
In the Splunk IT Service Intelligence Administration Manual:
