[splunk] 대시보드 패널 데이터 공유

https://docs.splunk.com/Documentation/Splunk/9.4.0/Viz/Savedsearches
Basic post-process search 예시를 약간 변형해서 정리

index=_internal source=*splunkd.log 
| stats count by component, log_level 
| stats sum(count) AS count by log_level

위와 같은 쿼리를 대시보드로 구성할 때 
기존 결과를 재활용해서 성능을 높일 수 있다.

* 패널A
index=_internal source=*splunkd.log 
| stats count by component, log_level 

* 패널B
[패널A의 결과값이 base]
| stats sum(count) AS count by log_level

대시보드 원본 모드에서 다음과 같이 하면 된다
- 패널A : search 태그에 id 를 지정한다
- 패널B : search 태그에 base 를 지정한다 (패널A 의 id 값)

<dashboard version="1.1" theme="light">
  <label>후처리</label>
  <row>
    <panel>
      <table>
        <search id="first">
          <query>index=_internal source=*splunkd.log 
| stats count by component, log_level</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <table>
        <search base="first">
          <query>stats sum(count) AS count by log_level</query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>