Dashboards & Visualizations

How to display both chart and statistics table on dashboard without two separate panels and searches?


Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?

Splunk Employee
Splunk Employee

I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:

  • panel object to group your chart and table element into the same "box" on a dashboard
  • searchTemplate in the global space in order to run a single background search to drive multiple visualizations

Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.

It should look something like this:

   <label>Single Panel Dashboard</label>
   <searchTemplate>index=_internal | top sourcetype</searchTemplate>


We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.

0 Karma


Splunk version?? Simple Xml or Advanced xml?

0 Karma

Splunk Employee
Splunk Employee

One option that may satisify your needs is to use sparklines to add time based detail to your tables:

Spark lines

If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.

The docs are located here for search templates.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...