topic Re: How to display both chart and statistics table on dashboard without two separate panels and searches? in Dashboards & Visualizations

How to display both chart and statistics table on dashboard without two separate panels and searches?

irfans — Tue, 22 Jul 2014 19:58:06 GMT

Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

okrabbe_splunk — Tue, 22 Jul 2014 20:04:02 GMT

One option that may satisify your needs is to use sparklines to add time based detail to your tables:

Spark lines

If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.

The docs are located here for search templates.

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

somesoni2 — Tue, 22 Jul 2014 21:03:43 GMT

Splunk version?? Simple Xml or Advanced xml?

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

irfans — Tue, 22 Jul 2014 21:05:16 GMT

We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

nfilippi_splunk — Tue, 22 Jul 2014 21:06:22 GMT

I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:

panel object to group your chart and table element into the same "box" on a dashboard
searchTemplate in the global space in order to run a single background search to drive multiple visualizations

Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.

It should look something like this:

<dashboard>
   <label>Single Panel Dashboard</label>
   <description/>
   <searchTemplate>index=_internal | top sourcetype</searchTemplate>
   <earliestTime>-60m</earliestTime>
   <latestTime>now</latestTime>
   <row>
     <panel>
       <chart>
         <title>myChart</title>
       </chart>
       <table>
         <title>myTable</title>
       </table>
     </panel>
  </row>
</dashboard>