Dashboards & Visualizations

How to pull a field from a saved report into a dashboard and display only one of the fields in a panel?

charliedgz
Path Finder

Is there a way to pull a field from a saved report into a dashboard and display only one of the fields in a panel? For instance, I have a saved search for the past 4 hours. I have 3 fields: total, avg, and valid. Let's say the numbers are 7009, 12, and 6576 respectively for example. I am trying to have different panels: One showing a gauge with the totals, one showing the average from the report, and one showing the valid number. Is there a way to pull the total from the report for one panel and avg from the report?

0 Karma

somesoni2
Revered Legend

You would've to use the ref feature of the search element in simple xml to reference a scheduled saved search. This it'll load the last run's results to dashboard panel, if one exists, or rerun the scheduled search. See more details with example here.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Reference_a_search_from_a_report

<search ref ="[name]">
....
References the report.
0 Karma

cmerriman
Super Champion

you could use the savedsearch command followed by fields

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Savedsearch

|savedsearch searchname|fields total

charliedgz
Path Finder

Ok, I tried doing this, but it keeps rerunning the search ( in my case 35 million events), even if I used a fix time range. I just want to abstract, say the 7009 without having to rerun the search.

0 Karma

cmerriman
Super Champion

sorry. try loadjob
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Loadjob

|loadjob savedsearch="charliedgz:search:searchname"
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...