Dashboards & Visualizations

How can I execute one search to display data on multiple panels in a dashboard?

nbharadwaj
Path Finder

How can I execute one search to display data on multiple panels in a dashboard?

I want to chart several metrics for the same criteria (same time range, same index etc). However I want to chart these metrics on separate charts- due to scaling issues and clarity.

So for a search like this:

index=A | stats count, avg(responseTime) by host

I want to chart count and avg(responseTime) on different charts on the same dashboard. However I dont want to split this up into two different searches for the two dashboard panels due to performance reasons.

Tags (2)

hiddenkirby
Contributor

I also found the ui-examples app (downloadable from splunkbase) very useful in this regard.

I beleive the one specifically you are looking for is called "inverted flow panel defined search" under simplified xml.

unless im way off.

gkanapathy
Splunk Employee
Splunk Employee

sideview
SplunkTrust
SplunkTrust

Actually that is correct, prior to 4.1 the flash charts will not work with this technique. Tables however did work fine back in 4.0.X.

0 Karma

nbharadwaj
Path Finder

This seems to apply only to 4.1 and above. I am on 4.0.10 - can you confirm this will work pre 4.1?

0 Karma

sideview
SplunkTrust
SplunkTrust

Its strange that the docs dont mention the limitations of working with postprocess. In a nutshell, beware that when you use postProcess it only gets the first 10,000 rows of the original search results to work with. So you can get inaccurate stats or missing rows in the final output.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...