base search

base search

noun

A search on which you can base multiple similar searches. For example, if you have a dashboard running several searches that are similar, you can save search resources by creating a base search for the dashboard. Panels in the dashboard use a post-process search to further modify the results of the base search.

In the context of IT Service Intelligence (ITSI), use KPI base searches to share a search definition across multiple KPIs that use the same data source. For example, if you have several KPIs based on the same sets of source events, but measuring on different fields, you can create base searches to consolidate these KPIs, reduce search load, and improve search performance.

For more information

In Splunk Enterprise Dashboards and Visualizations:

• Post-process searches

In the Splunk IT Service Intelligence Administration Manual:

• Create KPI base searches in ITSI