topic Re: show all panels output to single panel in a dashabord in Dashboards & Visualizations

show all panels output to single panel in a dashabord

kranthimutyala — Thu, 14 Nov 2019 01:12:00 GMT

Hi Splunkers,

I have 6 panels in my dashboard and all the panels have different underlying query but the output fields in the panel stats table are same and the results in all the panels look like the below sample table.

I want to club all the results into a single panel/table at the end.So i just want to display one panel which contains the results from all the other panels.

Thank you.

user action time object group difference modifier
zbc xyz 10-Sep hddh dj-dhdh 6 jhyy
dhdh cnnc 10-Sep fhfhf jjj-ggg 8 gg

Re: show all panels output to single panel in a dashabord

niketn — Thu, 14 Nov 2019 01:30:44 GMT

@kranthimutyala could you add more details as to why you have six different panels for similar results? What is the difference between each of the 6 different panels?

Also for the community to assist you better if you can provide your current SPL and sample data output for each of the six panels that would be great.

Please mock/anonymize any sensitive information before posting on Splunk Answers.

Re: show all panels output to single panel in a dashabord

ololdach — Thu, 14 Nov 2019 07:02:01 GMT

Hi,
I assume that you just want one final table in your dashboard and not 6 sub-tables plus one final. Nevertheless, the approach to solve this question is the same. What I suggest is to cascade the searches:

<dashboard>
<label>Test Dashboard</label>
<search id="result1">
<query>
  | makeresults | eval user="zbc" | eval action="xyz" | eval time="10-Sep" | eval object="hddh" | eval difference="1" 
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<search id="result2" base="result1">
<query>
  |append [ | makeresults | eval user="zyy" | eval action="Qyz" | eval time="11-Sep" | eval object="hddh" | eval difference="2" ]
</query>
</search>
<search id="result3" base="result2">
<query>
  |append [ | makeresults | eval user="zyty" | eval action="QQyz" | eval time="12-Sep" | eval object="hddh" | eval difference="3" ]
</query>
</search>
<row>
<panel>
  <table>
    <title>Result Table</title>
    <search base="result3">
      <query>|table *</query>

    </search>
  </table>
</panel>
</row>
</dashboard>

This executes the searches sequentially and appends the results
Hope it helps
Oliver

Re: show all panels output to single panel in a dashabord

kranthimutyala — Thu, 14 Nov 2019 09:14:12 GMT

I tried but not able to see any results being generated.Can you please provide sample run anywhere code .Thank you

Re: show all panels output to single panel in a dashabord

ololdach — Thu, 14 Nov 2019 13:17:46 GMT

Please create an empty dashboard, edit source and paste the code that I've inserted above.
Oliver

Re: show all panels output to single panel in a dashabord

kranthimutyala — Thu, 14 Nov 2019 13:45:28 GMT

Thanks for the update, but the export option for the result table panel is disabled .How to make that enable and download the CSV file

Re: show all panels output to single panel in a dashabord

ololdach — Thu, 14 Nov 2019 13:53:41 GMT

It is a known bug when using the base search feature. Please take a look at the "base-search" feature documentation. You can always press the "open in search". Once you have opened it in a new search window, you can export to csv. Alternatively, you could use the outputcsv command: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Outputcsv

Re: show all panels output to single panel in a dashabord

woodcock — Fri, 15 Nov 2019 01:19:34 GMT

Do it like this:

Your Search Here with all stuff combined
| multireport
[ stats some stuff here]
...
[ stats other stuff here]

Re: show all panels output to single panel in a dashabord

ololdach — Fri, 15 Nov 2019 07:04:33 GMT

Hi woodcock, do you refer to multisearch?