splunk dashboard

[Siddharthnegi]

In a dashboard I am using 2 searches and in each search I am using geostats command to build a map and show results on the map. Can I point these 2 searches on 1 map . meaning i want that rather than using geostats on each panel search I want it to be common for every panel so that i don't have to write it in every panel search.

[gcusello]

Hi @Siddharthnegi ,

it's possible to create a common search to use in more panels (for more infos see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Viz/Savedsearches#Post-process_searches ), only if the search is the same and you have different calculations in each panel from the search, e.g. in one panel you use stats and in one panel you use table.

Are your searches different or similar?

if they are similar, please share them, otherwise, it isn't possible.

Ciao.

Giuseppe

[Siddharthnegi]

yes all the searches are same only 1 line is different.
eg
search is same only 1 line is different like
in search 1 i am using
| search category = os_client

in search 2 i am using
| search category = os_server

Like this. Is this helpful

[gcusello]

hi @Siddharthnegi ,

let me know if my hint solve your requirement.

If you share your searches I culd help you.

Otherwise, please accect one solution for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

[Siddharthnegi]

so the searchers are

| inputlookup duerr_counters.csv
| search category="blsoft_total"
| rename "Company Code" as CompanyCode
| lookup location_map.csv CompanyCode OUTPUTNEW Lat, Long
| rename CompanyCode as "Company Code"
| lookup lkp-GlobalIpRange "Company Code" OUTPUTNEW Niederlassung
| fields "Company Code" Region category Lat Long Niederlassung
| geostats globallimit=93 latfield=Lat longfield=Long count by Niederlassung


| inputlookup duerr_counters.csv
| search category="blsoft_exceptions"
| rename "Company Code" as CompanyCode
| lookup location_map.csv CompanyCode OUTPUTNEW Lat, Long
| rename CompanyCode as "Company Code"
| lookup lkp-GlobalIpRange "Company Code" OUTPUTNEW Niederlassung
| fields "Company Code" Region category Lat Long Niederlassung
| geostats globallimit=93 latfield=Lat longfield=Long count by Niederlassung

only 2 line is different

[ITWhisperer]

Visualisations display the results of a search so can you not combine your searches into a single search and display that on a single map?