Dashboards & Visualizations

Is it possible to visualize multiple search results and alerts in the same dashboard?


Hello, newbie here again.

Trying to use 2 inputs for a form but separate the searches (these 2 inputs will be 2 different alerts) and incorporate search results into one graphical view. is this possible?

Thank you again.

Labels (1)
0 Karma


Hi Guiseppe, thanks for the reply. yes they are the same search with the exception of the second search have updated code. the goal is to merge the data to show the difference in execution time. I have the tokens $alertNameTok$ and $alertNameTok1$. Here's what I have for the code.

index=_internal source="*scheduler.log" app="hdo_monitoring" status="success" $alertNameTok$ $alertNameTok1$ earliest=$timetok.earliest$ latest=$timetok.latest$

| timechart span=10m first(run_time) first(result_count) by savedsearch_name

attached: snapshot - no results alt text

thank you!

0 Karma


Hi @owie6466,
with the few informations you shared I think that's probably possible, but, if you could share the searches and an example of the results yuo want it could be easier.

In addition, there's a thing not so clear:you say tha the two inputs are two alerts, are you meaning that the searches are the same of alerts or what else?


0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...