You may have noticed that, in our previous example, both of our queries started with the same actual query:
sourcetype="*" Forecast date_year=$myyear$ | timechart count as
"Forecast Events" by date_month
It is, of course, wasteful to run the same query four times. In prior versions of Splunk, using <searchPostProcess>, we can run the query once and then run commands on the results for each panel. The first step would be to move the initial query out of the panel to the top level of the XML.
The results from <searchTemplate> would be used by a panel if it has no query of its own, or it will be used as the source for <searchPostProcess>. One additional piece of information is needed: the fields that are needed by the panels. We can get this by using table, like so:
<?xml version='1.0' encoding='utf-8'?> <form> <searchTemplate> sourcetype="*" Forecast date_year=$myyear$ | timechart count as "Forecast Events" by date_month </searchTemplate>
This technique will work exactly like our previous example but will only run the query once, drawing more quickly and saving resources for everyone. However, more work is required, as we'll see in the next section.
Another approach for limiting the number of times a query would run is to use a <search> tag with an id in the attribute, then just reference the id elsewhere using the base attribute.