topic How to pull Table results from one dashboard to another? in Dashboards & Visualizations

How to pull Table results from one dashboard to another?

RLWOLFF — Mon, 06 Jun 2022 03:30:21 GMT

I want a main dashboard to pull results from multiple application dashboards. I do not want to do the same queries in the Main dashboard. Is this possible?

example:

<row>
<panel>
<table>
<title>Overall_Status</title>
<search>
<query>index=clo_application_logs host IN (xxxx.com) "Unable to read the file" OR "DB ERROR" OR "JMS Exception Occurred" OR "outOfMemory" OR "ERROR - PricingManager" OR "ERROR - DataService" | stats count
| eval Overall_Status=case(count>0,"CRITICAL", 1=1, "NORMAL")
| append [search index=clo_application_logs host IN (xxxx.com xxxx.comm) "FAIL" | stats count
| eval Overall_Status=case(count>0,"CRITICAL", 1=1, "NORMAL")]
| stats count by Overall_Status | eval colour=case(test=="NORMAL", "0", test=="CRITICAL", "1", 2=2, Unknown) | sort - colour | fields Overall_Status| head 1
| appendpipe [stats count | where count="0" | fillnull value="No Results" Overall_Status]</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Overall_Status">
<colorPalette type="map">{"CRITICAL":#DC4E41,"NORMAL":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>

Re: Pull Table results from one dashboard to another

richgalloway — Fri, 03 Jun 2022 23:30:31 GMT

One cannot pull (or push) results from one dashboard to another. You can, however, accomplish the same goal using a scheduled report.

In the application dashboard, edit the appropriate panel and convert it from an inline search into a report. Schedule that report to run at a suitable interval.

In the main dashboard, define a panel that uses a report. See https://docs.splunk.com/Documentation/Splunk/8.2.6/Viz/AddPanels#Create_a_panel_from_a_report for the details.

Once the scheduled report runs, both dashboards will display the most recent results.

Re: Pull Table results from one dashboard to another

gcusello — Sat, 04 Jun 2022 06:48:30 GMT

Hi @RLWOLFF,

you could schedule as alerts some searches (the same that you have ones in the other dashboards) that save their results in a lookup or (better) in a summary index and then use that summary index in your main dashboard.

Ciao.

Giuseppe