Dashboards & Visualizations

Is it possible to visualize multiple search results and alerts in the same dashboard?

owie6466
Explorer

Hello, newbie here again.

Trying to use 2 inputs for a form but separate the searches (these 2 inputs will be 2 different alerts) and incorporate search results into one graphical view. is this possible?

Thank you again.

Labels (1)
0 Karma

owie6466
Explorer

Hi Guiseppe, thanks for the reply. yes they are the same search with the exception of the second search have updated code. the goal is to merge the data to show the difference in execution time. I have the tokens $alertNameTok$ and $alertNameTok1$. Here's what I have for the code.

index=_internal source="*scheduler.log" app="hdo_monitoring" status="success" $alertNameTok$ $alertNameTok1$ earliest=$timetok.earliest$ latest=$timetok.latest$

| timechart span=10m first(run_time) first(result_count) by savedsearch_name

attached: snapshot - no results alt text

thank you!

0 Karma

gcusello
Legend

Hi @owie6466,
with the few informations you shared I think that's probably possible, but, if you could share the searches and an example of the results yuo want it could be easier.

In addition, there's a thing not so clear:you say tha the two inputs are two alerts, are you meaning that the searches are the same of alerts or what else?

Ciao.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!