topic Splunk Panels - Two Separate Searches in Dashboards & Visualizations

Splunk Panels - Two Separate Searches

mstrozyk — Tue, 05 Jun 2018 12:37:11 GMT

I was wondering if it is possible to create a panel (in a dashboard) that has two separate searches that are labeled accordingly? I'm looking to make it more visually inclusive. It would look something like this:

(Main Title)
(Subtitle for search)
(Search Results)
(Subtile for another search)
(Search Results for a different search)

END

Now with Values:

Fruit Statistics
Apple Stats
(A bunch of apple stats)
Orange Stats
(A bunch of orange stats)

END

There might not be a way to do this but I just wanted to ask.

Thanks!

Re: Splunk Panels - Two Separate Searches

kmorris_splunk — Tue, 05 Jun 2018 13:49:47 GMT

If I am understanding correctly, you may be able to achieve this visually by grouping the panels in your dashboard. Check out the Dashboard Examples app (available on splunkbase). There is an example of panel grouping in there.

Panel Grouping with Charts
Group multiple charts, tables, html panels, or events, aligning vertically.

Re: Splunk Panels - Two Separate Searches

kmorris_splunk — Tue, 05 Jun 2018 13:50:56 GMT

Dashboard Examples App

Re: Splunk Panels - Two Separate Searches

masonwhite — Tue, 05 Jun 2018 14:33:36 GMT

You can also explore multi-search tables with "appendcols" and "| transpose" ...

would go something like this:
index= sourcetype= "firstsearchhere" | table/stats countby (Main Title) (Search Results) | appendcols[search index= sourcetype= "secondsearchhere" | table/stats countby (Subtile for another search) (Search Results for a different search)] | transpose

table would look somewhat like:
Main Title
firstsearchtitle #######search results#####
secondsearchtitle #######searchresults#####