Dashboards & Visualizations

Is it possible to visualize multiple search results and alerts in the same dashboard?


Hello, newbie here again.

Trying to use 2 inputs for a form but separate the searches (these 2 inputs will be 2 different alerts) and incorporate search results into one graphical view. is this possible?

Thank you again.

Labels (1)
0 Karma


Hi Guiseppe, thanks for the reply. yes they are the same search with the exception of the second search have updated code. the goal is to merge the data to show the difference in execution time. I have the tokens $alertNameTok$ and $alertNameTok1$. Here's what I have for the code.

index=_internal source="*scheduler.log" app="hdo_monitoring" status="success" $alertNameTok$ $alertNameTok1$ earliest=$timetok.earliest$ latest=$timetok.latest$

| timechart span=10m first(run_time) first(result_count) by savedsearch_name

attached: snapshot - no results alt text

thank you!

0 Karma


Hi @owie6466,
with the few informations you shared I think that's probably possible, but, if you could share the searches and an example of the results yuo want it could be easier.

In addition, there's a thing not so clear:you say tha the two inputs are two alerts, are you meaning that the searches are the same of alerts or what else?


0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...