topic multiple search queries in one panel in Splunk Search

multiple search queries in one panel

luvukrishna — Fri, 24 Mar 2017 08:39:23 GMT

Can anyone help simplify attached XML to display result in one panel as described below

Current Result

3 panels
x Count
4

Y Count
5

z Count
15

Expecting to display as single table
X Count 4
Y Count 5
Z Count 15

Re: multiple search queries in one panel

Richfez — Fri, 24 Mar 2017 14:28:13 GMT

I think you are getting ahead of yourself a bit - as I read it from your description, the problem has nothing to do with panels and everything to do with the search. So, let's work on that.

Try a search like

service="xxxx" method="xx" types="x" | stats count | eval "Count Type"="X Count"
| append
    [ search service="yyyy" <other y stuff> | stats count | eval "Count Type"="Y Count"]
| append
    [ search service="zzzz" <other z stuff> | stats count | eval "Count Type"="Z Count"]
| table "Count Type", count

See if those results are what you'd like to have on the dashboard panel. If they are, then add them. 🙂 If they are not, please be sure to comment back (using the code button to paste in code!) with exactly what is or is not working with it and we'll be glad to help more!

Happy Splunking,
Rich

Re: multiple search queries in one panel

Richfez — Fri, 24 Mar 2017 14:37:04 GMT

If you really don't want to fix the searches and just want those panels to be better "combined", you could remove the two sections in your code that look like

</panel>
<panel>

from the two places in the middle of that chunk of code you took a screenshot of.

That won't quite fix it, but it'll be better and maybe that's all you need.

Re: multiple search queries in one panel

luvukrishna — Mon, 27 Mar 2017 03:05:49 GMT

Thanks Rich,