Dashboards & Visualizations

Is it possible to visualize multiple search results and alerts in the same dashboard?

Explorer

Hello, newbie here again.

Trying to use 2 inputs for a form but separate the searches (these 2 inputs will be 2 different alerts) and incorporate search results into one graphical view. is this possible?

Thank you again.

Labels (1)
0 Karma

Explorer

Hi Guiseppe, thanks for the reply. yes they are the same search with the exception of the second search have updated code. the goal is to merge the data to show the difference in execution time. I have the tokens $alertNameTok$ and $alertNameTok1$. Here's what I have for the code.

index=_internal source="*scheduler.log" app="hdo_monitoring" status="success" $alertNameTok$ $alertNameTok1$ earliest=$timetok.earliest$ latest=$timetok.latest$

| timechart span=10m first(run_time) first(result_count) by savedsearch_name

attached: snapshot - no results alt text

thank you!

0 Karma

SplunkTrust
SplunkTrust

Hi @owie6466,
with the few informations you shared I think that's probably possible, but, if you could share the searches and an example of the results yuo want it could be easier.

In addition, there's a thing not so clear:you say tha the two inputs are two alerts, are you meaning that the searches are the same of alerts or what else?

Ciao.
Giuseppe

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!