How can I execute one search to display data on multiple panels in a dashboard?
I want to chart several metrics for the same criteria (same time range, same index etc). However I want to chart these metrics on separate charts- due to scaling issues and clarity.
So for a search like this:
index=A | stats count, avg(responseTime) by host
I want to chart count and avg(responseTime) on different charts on the same dashboard. However I dont want to split this up into two different searches for the two dashboard panels due to performance reasons.
Please take a look at
for Simple XML dashboards, or
for advanced XML
Its strange that the docs dont mention the limitations of working with postprocess. In a nutshell, beware that when you use postProcess it only gets the first 10,000 rows of the original search results to work with. So you can get inaccurate stats or missing rows in the final output.
This seems to apply only to 4.1 and above. I am on 4.0.10 - can you confirm this will work pre 4.1?
Actually that is correct, prior to 4.1 the flash charts will not work with this technique. Tables however did work fine back in 4.0.X.
I also found the ui-examples app (downloadable from splunkbase) very useful in this regard.
I beleive the one specifically you are looking for is called "inverted flow panel defined search" under simplified xml.
unless im way off.