How can I execute one search to display data on multiple panels in a dashboard?

[nbharadwaj]

How can I execute one search to display data on multiple panels in a dashboard?

I want to chart several metrics for the same criteria (same time range, same index etc). However I want to chart these metrics on separate charts- due to scaling issues and clarity.

So for a search like this:

index=A | stats count, avg(responseTime) by host

I want to chart count and avg(responseTime) on different charts on the same dashboard. However I dont want to split this up into two different searches for the two dashboard panels due to performance reasons.

[hiddenkirby]

I also found the ui-examples app (downloadable from splunkbase) very useful in this regard.

I beleive the one specifically you are looking for is called "inverted flow panel defined search" under simplified xml.

unless im way off.

[gkanapathy]

Please take a look at

http://www.splunk.com/base/Documentation/latest/Developer/FormSearchPostProcess

for Simple XML dashboards, or

http://www.splunk.com/base/Documentation/latest/Developer/PostProcess

for advanced XML

[sideview]

Actually that is correct, prior to 4.1 the flash charts will not work with this technique. Tables however did work fine back in 4.0.X.

[nbharadwaj]

This seems to apply only to 4.1 and above. I am on 4.0.10 - can you confirm this will work pre 4.1?

[sideview]

Its strange that the docs dont mention the limitations of working with postprocess. In a nutshell, beware that when you use postProcess it only gets the first 10,000 rows of the original search results to work with. So you can get inaccurate stats or missing rows in the final output.