topic Re: splunk dashboard in Dashboards & Visualizations

splunk dashboard

Siddharthnegi — Tue, 30 Apr 2024 09:21:16 GMT

In a dashboard I am using 2 searches and in each search I am using geostats command to build a map and show results on the map. Can I point these 2 searches on 1 map . meaning i want that rather than using geostats on each panel search I want it to be common for every panel so that i don't have to write it in every panel search.

Re: splunk dashboard

ITWhisperer — Tue, 30 Apr 2024 09:33:57 GMT

Visualisations display the results of a search so can you not combine your searches into a single search and display that on a single map?

Re: splunk dashboard

gcusello — Tue, 30 Apr 2024 12:30:40 GMT

Hi @Siddharthnegi ,

it's possible to create a common search to use in more panels (for more infos see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Viz/Savedsearches#Post-process_searches ), only if the search is the same and you have different calculations in each panel from the search, e.g. in one panel you use stats and in one panel you use table.

Are your searches different or similar?

if they are similar, please share them, otherwise, it isn't possible.

Ciao.

Giuseppe

Re: splunk dashboard

Siddharthnegi — Wed, 01 May 2024 04:51:18 GMT

yes all the searches are same only 1 line is different.
eg
search is same only 1 line is different like
in search 1 i am using
| search category = os_client

in search 2 i am using
| search category = os_server

Like this. Is this helpful

Re: splunk dashboard

gcusello — Wed, 01 May 2024 05:14:54 GMT

hi @Siddharthnegi ,

let me know if my hint solve your requirement.

If you share your searches I culd help you.

Otherwise, please accect one solution for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: splunk dashboard

Siddharthnegi — Wed, 01 May 2024 09:27:01 GMT

so the searchers are

| inputlookup duerr_counters.csv | search category="blsoft_total" | rename "Company Code" as CompanyCode | lookup location_map.csv CompanyCode OUTPUTNEW Lat, Long | rename CompanyCode as "Company Code" | lookup lkp-GlobalIpRange "Company Code" OUTPUTNEW Niederlassung | fields "Company Code" Region category Lat Long Niederlassung | geostats globallimit=93 latfield=Lat longfield=Long count by Niederlassung | inputlookup duerr_counters.csv | search category="blsoft_exceptions" | rename "Company Code" as CompanyCode | lookup location_map.csv CompanyCode OUTPUTNEW Lat, Long | rename CompanyCode as "Company Code" | lookup lkp-GlobalIpRange "Company Code" OUTPUTNEW Niederlassung | fields "Company Code" Region category Lat Long Niederlassung | geostats globallimit=93 latfield=Lat longfield=Long count by Niederlassung

only 2 line is different