What is an example of the simple XML syntax for a base search and its post-srooess search?

Question

Options

• A<search id="myBaseSearch">, <search base="myBaseSearch">
• B<search globalsearch="myBaseSearch">, <search globalsearch>
• C<panel id="myBaseSearch">, <panel base="myBaseSearch">
• D<search id="myGlobalSearch">, <search base="myBaseSearch">

• A
  92% (24)
• C
  4% (1)
• D
  4% (1)

Explanation

Option A is correct because Splunk Simple XML uses the id attribute on a <search> element to define a named base search, and then a separate <search base="..."> element references that base search by name to run a post-process query on the already-retrieved results.

B is wrong because globalsearch is not a valid attribute in Simple XML - it does not exist in the Splunk dashboard schema.

C is wrong because <panel> is a layout/container element, not a search element; base searches must use <search>, not <panel>.

D is a trap - the second half (<search base="myBaseSearch">) is syntactically correct, but the first half uses id="myGlobalSearch", so the IDs don't match and the post-process search would never link to the base search.

Memory tip: Think "id to define, base to bind" - you id the base search to name it, and use base to bind a post-process search to that name.

No community discussion yet for this question.