Dashboards & Visualizations
Highlighted

How to display both chart and statistics table on dashboard without two separate panels and searches?

Explorer

Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?

Highlighted

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

Splunk Employee
Splunk Employee

One option that may satisify your needs is to use sparklines to add time based detail to your tables:

Spark lines

If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.

The docs are located here for search templates.

Highlighted

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

SplunkTrust
SplunkTrust

Splunk version?? Simple Xml or Advanced xml?

0 Karma
Highlighted

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

Explorer

We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.

0 Karma
Highlighted

Re: How to display both chart and statistics table on dashboard without two separate panels and searches?

Splunk Employee
Splunk Employee

I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:

  • panel object to group your chart and table element into the same "box" on a dashboard
  • searchTemplate in the global space in order to run a single background search to drive multiple visualizations

Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.

It should look something like this:

<dashboard>
   <label>Single Panel Dashboard</label>
   <description/>
   <searchTemplate>index=_internal | top sourcetype</searchTemplate>
   <earliestTime>-60m</earliestTime>
   <latestTime>now</latestTime>
   <row>
     <panel>
       <chart>
         <title>myChart</title>
       </chart>
       <table>
         <title>myTable</title>
       </table>
     </panel>
  </row>
</dashboard>