How to Move a Base Search Dashboard from Classic to Dashboard Studio in Splunk
By Alex Trejo, Splunk Consultant II
As Splunk develops Dashboard Studio into the preferred dashboard experience, migrating dashboards that rely on base searches remains essential. Dashboard Studio achieves the same performance optimizations through chain searches, which are fully supported in Splunk Enterprise 9.4.x.
Step-by-Step: Migrating a Base Search Dashboard
1. Review Your Classic Dashboard
Open the Simple XML source and locate the <search id=”baseSearch”> block (base search SPL) and any panels that use base=”baseSearch” for post-processing.
2. Clone or Export the Dashboard
Copy the XML via Edit → Source as a backup. In Splunk 9.3+, you can Clone → Studio Dashboard to partially convert the layout to Studio—but base/post‑processing logic typically must be rebuilt manually.
3. Create a New Dashboard Studio Dashboard
In Splunk, go to Dashboards and create a new Dashboard Studio dashboard. Choose Absolute or Grid layout and click Create.
4. Implement the Base Search as a Chain Search
In Studio’s visual editor:
– Select a visualization (even a placeholder),
– Open Configuration → Data sources → + Set up data source → Create Base Search,
– Input your base search SPL, name it (e.g. base_search_ds), then apply.
5. Add Chain Searches for Each Panel
For panels that used post-process:
– Select the panel,
– Configuration → Data sources → + Set up data source → Create Chain Search,
– Use base_search_ds as the parent and append the panel’s post-process SPL (e.g. | stats count by host).
6. Connect Visualizations to Chain Searches
Assign each visualization’s primary data source to the new chain search and configure chart options as desired.
7. Save and Test
Save the dashboard.
Confirm:
Base search returns results.
All chain searches render the expected outputs.
Tokens, inputs, and time ranges function correctly.
Advantages of Dashboard Studio with Chain Searches
Modern Interface
Dashboard Studio provides a modern, drag-and-drop UI, allowing precise control over layout and styling.
Better Performance
Chain searches let you reuse one transforming base search across multiple panels, reducing redundancy and improving load times.
Flexible Layout Options
Grid and Absolute layouts allow more design freedom than Classic XML.
Token and Input Improvements
Studio handles tokens and inputs more seamlessly. Time range tokens must be in the base search, but can be referenced in chains.
JSON-Based Definitions
Dashboards are stored in JSON (not XML), simplifying version control and automation.
Troubleshooting Tips
Chain Search Returns No Data
Make sure the base search includes all necessary fields (uses stats, fields, or other transforming commands). Non-transforming base searches may drop fields needed downstream.
Missing Panels After Clone
Auto-conversion may omit post-process panels. Manually recreate these using chain searches.
Performance or Timeout Issues
Avoid large raw event sets; use transforming base searches. Be aware of the default 500,000-event retention and 30-second client timeout limits.
Infinite Refresh Loops
Only chain-level token changes should refresh dependent panels; base refreshes cascade through chains. Avoid nesting beyond one extra chain level.
Unable to Use collect Command
collect isn’t supported in base or chain searches—use inline searches if needed.
Summary
Dashboard Studio offers a contemporary way to build rich, performant dashboards using chain searches in place of Classic base/post-process constructs. Follow the documented process in the visual editor, ensure your base search is transforming, and keep chain design streamlined. You’ll gain a more maintainable, scalable, and visually flexible dashboard.
Need help migrating your dashboards? Connect with TekStream to discuss your Dashboard Studio transition.
About the Author
Alex Trejo is a bilingual Splunk consultant, who has experience and a strong enthusiasm for machine learning, automation, and data science. Alex has done research and experimentation with different models of machine learning including data augmentation using Generative Adversarial Networks (GANs). Through his willingness to learn, Alex can tackle problems from different perspectives to ensure the best possible solution.