Dashboards & Visualizations
Highlighted

How can I execute one search to display data on multiple panels in a dashboard?

Path Finder

How can I execute one search to display data on multiple panels in a dashboard?

I want to chart several metrics for the same criteria (same time range, same index etc). However I want to chart these metrics on separate charts- due to scaling issues and clarity.

So for a search like this:

index=A | stats count, avg(responseTime) by host

I want to chart count and avg(responseTime) on different charts on the same dashboard. However I dont want to split this up into two different searches for the two dashboard panels due to performance reasons.

Tags (2)
Highlighted

Re: How can I execute one search to display data on multiple panels in a dashboard?

Splunk Employee
Splunk Employee
Highlighted

Re: How can I execute one search to display data on multiple panels in a dashboard?

SplunkTrust
SplunkTrust

Its strange that the docs dont mention the limitations of working with postprocess. In a nutshell, beware that when you use postProcess it only gets the first 10,000 rows of the original search results to work with. So you can get inaccurate stats or missing rows in the final output.

0 Karma
Highlighted

Re: How can I execute one search to display data on multiple panels in a dashboard?

Path Finder

This seems to apply only to 4.1 and above. I am on 4.0.10 - can you confirm this will work pre 4.1?

0 Karma
Highlighted

Re: How can I execute one search to display data on multiple panels in a dashboard?

SplunkTrust
SplunkTrust

Actually that is correct, prior to 4.1 the flash charts will not work with this technique. Tables however did work fine back in 4.0.X.

0 Karma
Highlighted

Re: How can I execute one search to display data on multiple panels in a dashboard?

Contributor

I also found the ui-examples app (downloadable from splunkbase) very useful in this regard.

I beleive the one specifically you are looking for is called "inverted flow panel defined search" under simplified xml.

unless im way off.