It is possible to modify already existing report within Splunk dashboard?

Question

I have already created report in Splunk: "splunk_report". I want to use it in Splunk dashboard.

I have already add new panel -> new from report, but now it shows me a table (as it was defined in saved report) I would like to get the total number of rows in this table. It is possible to make count of current report? eg. "splunk_report" | stats count(system)

I do not want to copy whole search query, because when search in report change in the future, I have to change it in 2 places.

Answer 1

I have found another solution: create saved search and refer to existing report:

<search id="save_search" ref="splunk_report">

And in second saved search add base search:

<search id="save_search2" base="save_search">
    <query>| stats count(system)</query>

Answer 2

Unless you add the report as an inline search (or the report generates a lookup via outputlookup), what you're describing isn't possible.

If you add it as an inline search, you're back to your initial problem of needing to update it each inline search use as well as the original report

I often make use of scheduled reports to create lookup tables, though (for performance reasons). If you do that, then you can just reference the lookup table on your dashboard, and do with it whatever you want like any other lookup table:

| inputlookup mylookup.csv
| stats count

Or

| inputlookup mylookup.csv
| stats count by system

Etc

If you want to add summary data to the stats table on the dashboard, format the visualization and add totals: