topic Re: How to merge two dashboards into one? in Dashboards & Visualizations

How to merge two dashboards into one?

swetar — Wed, 01 Aug 2018 11:55:57 GMT

Hi,

There are two graphs, each showing status of two instances. I wanted to merge both graphs into one.
Both have the same source type and index. Can anyone suggest on this?

Thanks

Re: How to merge two dashboards into one?

richgalloway — Wed, 01 Aug 2018 13:17:53 GMT

Please provide the searches for the graphs and we can try to help you merge them.

Re: How to merge two dashboards into one?

DalJeanis — Wed, 01 Aug 2018 15:57:57 GMT

As well as _time, you have two different dimensions, the instance number and the various readings, so you're probably better off just putting two separate panels on the same dash. Timechart doesn't handle multiple dimensions that well, so you'd end up with the individual lines being "instance1 - cpu", "instance2 - cpu" and so on, which isn't very readable.

Re: How to merge two dashboards into one?

swetar — Wed, 08 Aug 2018 02:44:15 GMT

Thanks for your reply. I was able to merge both the chart in the following way..
SPL side# Sourcetype1 appendcols [search sourcetype2
then I used chart overlay to overlap both of them.

Re: How to merge two dashboards into one?

richgalloway — Wed, 08 Aug 2018 09:59:46 GMT

@swetar, If your problem is resolved, please accept the answer to help future readers.

Re: How to merge two dashboards into one?

DalJeanis — Wed, 08 Aug 2018 18:34:31 GMT

@swetar - appendcols is going to fail the moment that either query returns a different number of results. If you provide the underlying searches, then we can help you merge them in a way that will work in all scenarios.

In general, you want to aim for

(index=foo1 sourcetype=bar whatever other search terms)
OR
(index=foo2 sourcetype=baz whatever other search terms)
| fields  ... list all the fields you want to keep ...
| eval fields1 = create  any fields you need to calculate 
| timechart span=15m 
  count as nameOfFirstLine
  sum(somefield) as nameOfSecondLine    
  aggregatefunction(fields) as nameOfThirdLine
  aggregatefunction(fields) as nameOfFourthLine

The above should work under all cases,as long as the aggregate functions are operating on fields that will only be in the relevant events. You can control that either by building new fields that only exist on the right kind of record, or by using an eval in the aggregate function... which is an advanced method of coding that you may want to avoid for now.

Re: How to merge two dashboards into one?

swetar — Tue, 29 Sep 2020 20:49:36 GMT

@DalJeanis I m using the below SPL and its working fine ..:)

sourcetype="oracle_sourcetype1XXXXXX" | eval V_INST_NAME= case(INST_ID=="1","test1",INST_ID=="2","test2")
| where like (V_INST_NAME,"%")
|timechart span=10m first(P_COUNT) as PQ by INST_ID |rename 1 as "Parallel Count for test1" 2 as "Parallel Count for test2"
| filldown
| appendcols
[search sourcetype = oracle_sourcetype2YYYYYYY | eval V_INST_NAME= case(INST_ID=="1","test1",INST_ID=="2","test2") |where like (V_INST_NAME,"%")
| timechart span=10m first(SESSIONS_COUNT) as sessions_count by INST_ID
| rename 1 as "Session Count for test1" 2 as "Session Count for test2"
| filldown ]