Dashboards & Visualizations

Placing two search results in single panel of dashboard

srajanbabu
Explorer

I have two different panels of dashboard as the following

<dashboard>
  <label>xmlcheck</label>
  <row>
    <table>
        <searchString><![CDATA[source="FTPLOG.log" "Customer has successfully retrieved file"
             | rex "::\s(?<timestamp>\S+)\s"| rex "^\S+\s(?<userid>\S+)\." 
             | rex "\s(?<file_name>\S+)\s\((?<record_count>\d+)\srecords/(?<byte_count>\d+)\sbytes\)$"
             | stats count as FileCount list(file_name) as FileName sum(record_count) as RecordCount sum(byte_count) as ByteCount by timestamp userid 
             | where RecordCount !=0 AND ByteCount !=0]]>
         </searchString>
      </table>
  </row>
  <row>
    <table>
        <searchString><![CDATA[source="FTPLOG.log"| rex "^\S+\s(?<userid>\w+\.[0-9a-zA-Z]{4})" 
                | stats distinct_count(userid)]]>
        </searchString>
      </table>
  </row>
</dashboard>

I want to display these two search results in same single panel of a dashboard.
Can anyone help me on this.

Tags (1)
0 Karma
1 Solution

melting
Splunk Employee
Splunk Employee

There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it.

<dashboard>
  <row grouping="2">
    <table>
      ...
    </table>
    <table>
      ...
    </table>
  </row>
</dashboard>

There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row

Also you can check out the Splunk 6 Dashboard Examples App

View solution in original post

melting
Splunk Employee
Splunk Employee

There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it.

<dashboard>
  <row grouping="2">
    <table>
      ...
    </table>
    <table>
      ...
    </table>
  </row>
</dashboard>

There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row

Also you can check out the Splunk 6 Dashboard Examples App

srajanbabu
Explorer

This is really working ,I could get two search results in single panel.Thanks a lot.

0 Karma

anjafischer
Path Finder

Couldn't you just put both tags into the same tag?
Then the structure would be

<dashboard>
<label>xmlcheck</label>
<row>
<searchstring>your first search</searchstring>
<searchstring>your second search</searchstring>
</row>
</dashboard>

If that doesn't work you might have to use Advanced XML instead. Check out this thread.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...