Dashboards & Visualizations

How to display both chart and statistics table on dashboard without two separate panels and searches?

irfans
Explorer

Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?

nfilippi_splunk
Splunk Employee
Splunk Employee

I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:

  • panel object to group your chart and table element into the same "box" on a dashboard
  • searchTemplate in the global space in order to run a single background search to drive multiple visualizations

Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.

It should look something like this:

<dashboard>
   <label>Single Panel Dashboard</label>
   <description/>
   <searchTemplate>index=_internal | top sourcetype</searchTemplate>
   <earliestTime>-60m</earliestTime>
   <latestTime>now</latestTime>
   <row>
     <panel>
       <chart>
         <title>myChart</title>
       </chart>
       <table>
         <title>myTable</title>
       </table>
     </panel>
  </row>
</dashboard>

irfans
Explorer

We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.

0 Karma

somesoni2
Revered Legend

Splunk version?? Simple Xml or Advanced xml?

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

One option that may satisify your needs is to use sparklines to add time based detail to your tables:

Spark lines

If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.

The docs are located here for search templates.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...