Splunk ver.: 6
Sideview utls ver.: 3.2.3
I'm trying to create a reporting page for a monthly report that will summarize the total IDS alerts based on severity. I currently have the dashboard set up to display the total count of IDS alerts then break it down by severity (ex. High Med Low). This break down is displayed as a Radial gauge with a list of the top 5 alerts for that severity in a separate panel below the corresponding gauge. What I would like to do is combine the two panels into one panel.
Search for the radial gauge panel:
sourcetype="ids" | stats count
Search for the top 5 list panel:
sourcetype="ids" severity=high | top signature,category,severity limit=5
Is this possible? I've tried looking at the dashboard in sideview utils but I've not seen a way to do it there either.
Two modules will share a panel if you set their layoutPanel
attribute to the same value.
Two modules will share a panel if you set their layoutPanel
attribute to the same value.