Dashboards & Visualizations

How to display panel side by side instead of the default?

lsy9891
Engager

Hi
I have a pie chart and a table that I want to display side by side and now in different rows. I edited the XML to be in the same row tag but it doesn't work?
Here's my code.

<dashboard theme="dark">
  <label>SWAT</label>
  <row>
    <panel>
      <title>Orders</title>
      <chart>
        <title>Total Errors per Channel</title>
        <search base="BaseSearch">
          <query> chart sum("#Errors") AS TotalError  BY Channel</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
      <table>
        <title>Error type per channel</title>
        <search id="BaseSearch">
          <query>earliest=-1d@d latest=@d index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?&lt;type&gt;.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | appendpipe [ stats sum("#Errors") AS "#Errors" BY Channel | eval "Error Type"="Total for Channel" ] | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row></dashboard>
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi lsy9891,
if i correctly understood, you want to move a panel from a row to another where there is another panel, correct?
if this is your need, if you edit your dashboard, in the UI interface you can move a panel using your mouse.
Anyway, in your dashboard I see that is missing the panel tag between Chart and Table, in other words:

<dashboard theme="dark">
   <label>SWAT</label>
   <row>
     <panel>
       <title>Orders</title>
       <chart>
         <title>Total Errors per Channel</title>
         <search base="BaseSearch">
           <query> chart sum("#Errors") AS TotalError  BY Channel</query>
         </search>
         <option name="charting.chart">pie</option>
         <option name="charting.drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </chart>
    </panel>
    <panel>
       <table>
         <title>Error type per channel</title>
         <search id="BaseSearch">
           <query>earliest=-1d@d latest=@d index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?<type>.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | appendpipe [ stats sum("#Errors") AS "#Errors" BY Channel | eval "Error Type"="Total for Channel" ] | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X</query>
           <earliest>-60m</earliest>
           <latest>now</latest>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row></dashboard>

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...