Dashboards & Visualizations

Placing two search results in single panel of dashboard

srajanbabu
Explorer

I have two different panels of dashboard as the following

<dashboard>
  <label>xmlcheck</label>
  <row>
    <table>
        <searchString><![CDATA[source="FTPLOG.log" "Customer has successfully retrieved file"
             | rex "::\s(?<timestamp>\S+)\s"| rex "^\S+\s(?<userid>\S+)\." 
             | rex "\s(?<file_name>\S+)\s\((?<record_count>\d+)\srecords/(?<byte_count>\d+)\sbytes\)$"
             | stats count as FileCount list(file_name) as FileName sum(record_count) as RecordCount sum(byte_count) as ByteCount by timestamp userid 
             | where RecordCount !=0 AND ByteCount !=0]]>
         </searchString>
      </table>
  </row>
  <row>
    <table>
        <searchString><![CDATA[source="FTPLOG.log"| rex "^\S+\s(?<userid>\w+\.[0-9a-zA-Z]{4})" 
                | stats distinct_count(userid)]]>
        </searchString>
      </table>
  </row>
</dashboard>

I want to display these two search results in same single panel of a dashboard.
Can anyone help me on this.

Tags (1)
0 Karma
1 Solution

melting
Splunk Employee
Splunk Employee

There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it.

<dashboard>
  <row grouping="2">
    <table>
      ...
    </table>
    <table>
      ...
    </table>
  </row>
</dashboard>

There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row

Also you can check out the Splunk 6 Dashboard Examples App

View solution in original post

melting
Splunk Employee
Splunk Employee

There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it.

<dashboard>
  <row grouping="2">
    <table>
      ...
    </table>
    <table>
      ...
    </table>
  </row>
</dashboard>

There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row

Also you can check out the Splunk 6 Dashboard Examples App

srajanbabu
Explorer

This is really working ,I could get two search results in single panel.Thanks a lot.

0 Karma

anjafischer
Path Finder

Couldn't you just put both tags into the same tag?
Then the structure would be

<dashboard>
<label>xmlcheck</label>
<row>
<searchstring>your first search</searchstring>
<searchstring>your second search</searchstring>
</row>
</dashboard>

If that doesn't work you might have to use Advanced XML instead. Check out this thread.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...