https://community.splunk.com/t5/Splunk-Search/Compare-2-queries-in-a-dashboard/m-p/540461#M152904 <P>Here is the source for the dashboard.&nbsp;</P><LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;test-1&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="field1"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;input type="time" token="field2"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;time-window-1&lt;/title&gt; &lt;event&gt; &lt;search&gt; &lt;query&gt;index=dev sourcetype!=warn component AND errormessage earliest=$field1.earliest$ latest=$field1.latest$ | dedup errormessage,component&lt;/query&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="list.drilldown"&gt;none&lt;/option&gt; &lt;option name="list.wrap"&gt;1&lt;/option&gt; &lt;option name="maxLines"&gt;5&lt;/option&gt; &lt;option name="raw.drilldown"&gt;full&lt;/option&gt; &lt;option name="rowNumbers"&gt;0&lt;/option&gt; &lt;option name="table.drilldown"&gt;all&lt;/option&gt; &lt;option name="table.sortDirection"&gt;asc&lt;/option&gt; &lt;option name="table.wrap"&gt;1&lt;/option&gt; &lt;option name="type"&gt;list&lt;/option&gt; &lt;/event&gt; &lt;/panel&gt; &lt;panel&gt; &lt;title&gt;time-window-2&lt;/title&gt; &lt;event&gt; &lt;search&gt; &lt;query&gt;index=dev sourcetype!=warn component AND errormessage earliest=$field2.earliest$ latest=$field2.latest$ | dedup errormessage,component&lt;/query&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="list.drilldown"&gt;none&lt;/option&gt; &lt;option name="list.wrap"&gt;1&lt;/option&gt; &lt;option name="maxLines"&gt;5&lt;/option&gt; &lt;option name="raw.drilldown"&gt;full&lt;/option&gt; &lt;option name="rowNumbers"&gt;0&lt;/option&gt; &lt;option name="table.drilldown"&gt;all&lt;/option&gt; &lt;option name="table.sortDirection"&gt;asc&lt;/option&gt; &lt;option name="table.wrap"&gt;1&lt;/option&gt; &lt;option name="type"&gt;list&lt;/option&gt; &lt;/event&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE> Fri, 19 Feb 2021 01:18:12 GMT Joe20 2021-02-19T01:18:12Z https://community.splunk.com/t5/Splunk-Search/Compare-2-queries-in-a-dashboard/m-p/540457#M152903 <P>hello All,&nbsp;</P><P>I have created a dashboard with two panels. The first panel runs a search (query below) for time-window-1 and the second panel runs the same search for time-windows-2.&nbsp; Both the time windows are customizable on the dashboard and passed as parameters to the query as shown below.&nbsp;</P><P>index=dev sourcetype!=warn component AND errormessage earliest=$field1.earliest$ latest=$field1.latest$ | dedup errormessage,component</P><P>Currently each panel displays the unique results in the respective time window.</P><P>I want&nbsp; the dashboard to compare the results of time-window-1 and time-window-2 and display :</P><P>1. The unique results that are present in&nbsp;time-window-1 and NOT in time-window-2&nbsp; &nbsp;</P><P>2.&nbsp;The unique results that are present in&nbsp;time-window-2 and NOT in time-window-1</P><P>&nbsp;</P><P>Please help.</P><P>&nbsp;</P><P>&nbsp;&nbsp;</P> Fri, 19 Feb 2021 00:04:03 GMT https://community.splunk.com/t5/Splunk-Search/Compare-2-queries-in-a-dashboard/m-p/540457#M152903 Joe20 2021-02-19T00:04:03Z https://community.splunk.com/t5/Splunk-Search/Compare-2-queries-in-a-dashboard/m-p/540461#M152904 <P>Here is the source for the dashboard.&nbsp;</P><LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;test-1&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="field1"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;input type="time" token="field2"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;time-window-1&lt;/title&gt; &lt;event&gt; &lt;search&gt; &lt;query&gt;index=dev sourcetype!=warn component AND errormessage earliest=$field1.earliest$ latest=$field1.latest$ | dedup errormessage,component&lt;/query&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="list.drilldown"&gt;none&lt;/option&gt; &lt;option name="list.wrap"&gt;1&lt;/option&gt; &lt;option name="maxLines"&gt;5&lt;/option&gt; &lt;option name="raw.drilldown"&gt;full&lt;/option&gt; &lt;option name="rowNumbers"&gt;0&lt;/option&gt; &lt;option name="table.drilldown"&gt;all&lt;/option&gt; &lt;option name="table.sortDirection"&gt;asc&lt;/option&gt; &lt;option name="table.wrap"&gt;1&lt;/option&gt; &lt;option name="type"&gt;list&lt;/option&gt; &lt;/event&gt; &lt;/panel&gt; &lt;panel&gt; &lt;title&gt;time-window-2&lt;/title&gt; &lt;event&gt; &lt;search&gt; &lt;query&gt;index=dev sourcetype!=warn component AND errormessage earliest=$field2.earliest$ latest=$field2.latest$ | dedup errormessage,component&lt;/query&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="list.drilldown"&gt;none&lt;/option&gt; &lt;option name="list.wrap"&gt;1&lt;/option&gt; &lt;option name="maxLines"&gt;5&lt;/option&gt; &lt;option name="raw.drilldown"&gt;full&lt;/option&gt; &lt;option name="rowNumbers"&gt;0&lt;/option&gt; &lt;option name="table.drilldown"&gt;all&lt;/option&gt; &lt;option name="table.sortDirection"&gt;asc&lt;/option&gt; &lt;option name="table.wrap"&gt;1&lt;/option&gt; &lt;option name="type"&gt;list&lt;/option&gt; &lt;/event&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE> Fri, 19 Feb 2021 01:18:12 GMT https://community.splunk.com/t5/Splunk-Search/Compare-2-queries-in-a-dashboard/m-p/540461#M152904 Joe20 2021-02-19T01:18:12Z