Dashboards & Visualizations

Best way to add multiple(30+) panels to a splunk dashboard

HattrickNZ
Motivator

What is the Best way to add multiple panels to a splunk dashboard?

I currently have a dashboard where I want to add 30+ panels which are just very simple timecharts for the last 24 hours.

I have all the searches and titles I want like this

search title 
index=*... title1
...
index=*... title30

The best way I can think of is to just add them individually
1 - Edit dashborad - Add panel (copy paste search and title), Add panel .... repeat.
2 - Use XML - Create 1 panel, copy and paste this panel X times and then edit accordingly.

Is there a better way than this very repetitive task?

0 Karma

cmerriman
Super Champion

Are you using the same search over and over again except only changing a small aspect of it in each panel? If so, instead of opening 30 searches, you might want to use post-process.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/Savedsearches#Post-process_searches_2
Otherwise, my easiest suggestion would be to build the first panel, copy the xml source code, paste and edit. Repeat. It’s quicker to make small changes in a search string in the source code when you need to do it over and over and over.

HattrickNZ
Motivator

tks I'll have a look at that.

I am olnly changing the KPI
index=... | timechart span=5m sum(KPI1) by device
...
index=... | timechart span=5m sum(KPI30) by device

I'll probs copy and paste the xml and edit in a editor as I find the splunk one probably not the best for this scenario.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...