Dashboards & Visualizations

Create two visualizations from same data set in a dashboard

kentont1
New Member

I have a search query that returns a list of transactions and their times. I've used that to create two kinds of visualizations: a timechart showing fluctuations over time and single value gauges showing summary values for the time period. In my dashboard, I have these as two separate panels, which I assume results in two separate queries for the same dataset, which seems like a waste of resources.... Is there a way for two visualizations to reference the same data set?

BTW, I assume that something like this is possible using Splunk datasets, but I don't believe my admin has given me permission to generate them 😞  So is there any way of doing this just within the dashboard itself without using datasets?

Labels (2)
0 Karma

adityakhetan
Loves-to-Learn Lots

You can use base search in your dashboard. In that case your query will run only once.

<dashboard>
<label>NAME</lbael>
<search id="baseSearch">
    <query>
       index=xyz sourcetype=abc ....
    </query>
</search>
<row>
    <panel>
      <chart>
        <title>PANEL 1</title>
        <search base="baseSearch">
          <query>
            | timechart .....
          </query>
        </search>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Panel 2</title>
        <search base="baseSearch">
          <query>
            | stats count ....
          </query>
        </search>
      </chart>
    </panel>
  </row>
</dashboard>

 

So your search will run once and transforming commands on the result set will be applied in each panel.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...