A base search in Splunk is a foundational search query defined within a dashboard that can be referenced by multiple panels. This approach promotes efficiency by allowing multiple panels to display different aspects or visualizations of the same dataset without executing separate searches for each panel.

Key Points:

Definition: A base search is a primary search defined once in a dashboard's XML and referenced by other panels through post-process searches.

Post-Process Searches: These are additional search commands applied to the results of the base search. They refine or transform the base search results to meet specific panel requirements.

Benefits:

Performance Optimization: Reduces the number of searches executed, thereby conserving system resources.

Consistency: Ensures all panels referencing the base search use the same dataset, maintaining uniformity across the dashboard.

Example:

Consider a dashboard that needs to display various statistics about web traffic:

Base Search:

<search name='base_search'>

index=web_logs | stats count by status_code

</search>

Panel 1 (Total Requests):

<title>Total Requests</title>

<search base='base_search'>

| stats sum(count) as total_requests

</search>

Panel 2 (Error Rate):

<title>Error Rate</title>

<search base='base_search'>

| where status_code >= 400

| stats sum(count) as error_count

</search>

In this example:

The base_search retrieves the count of events grouped by status_code from the web_logs index.

Panel 1 calculates the total number of requests by summing the count field.

Panel 2 filters for error status codes (400 and above) and calculates the total number of errors.

By defining a base search, both panels utilize the same initial dataset, ensuring consistency and reducing redundant processing.

Splunk Documentation - Base Search