Dashboards & Visualizations

How to display both chart and statistics table on dashboard without two separate panels and searches?


Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?

Splunk Employee
Splunk Employee

I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:

  • panel object to group your chart and table element into the same "box" on a dashboard
  • searchTemplate in the global space in order to run a single background search to drive multiple visualizations

Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.

It should look something like this:

   <label>Single Panel Dashboard</label>
   <searchTemplate>index=_internal | top sourcetype</searchTemplate>


We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.

0 Karma


Splunk version?? Simple Xml or Advanced xml?

0 Karma

Splunk Employee
Splunk Employee

One option that may satisify your needs is to use sparklines to add time based detail to your tables:

Spark lines

If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.

The docs are located here for search templates.