Splunk Search

1 saved search for 2 panels

0range
Communicator

Hi.
I have a dashboard with two panels (PC- and mobile site visits, for example, and they are divided by field src [src=mob vs. src=NULL]). I want to make ONE saved search that aggregates all needed data for both searches and then divide the data by the values of parameter "src" to show onto this panels.
How can I do this?

sowings
Splunk Employee
Splunk Employee

I'm assuming you're using the simple XML format.

This format permits the use of a single search string driving multiple panels. This is done with the main body of the search being enclosed in a searchTemplate element. Any other panel which needs to modify this search can do so with a searchPostProcess element. This acts like a | <rest of search> phrase would be when executed in the search bar. A brief example follows:


<form>
<searchTemplate>index=site_visits</searchTemplate>
<fieldset>
<input type="time"/>
</fieldset>
<row>
<chart>
<title>Mobile visits over time</title>
<searchPostProcess>search src=mob | timechart count<searchPostProcess>
</chart>
<chart>
<title>PC visits over time</title>
<searchPostProcess>where isnull(src) | timechart count<searchPostProcess>
</chart>
</row>
</form>

wpreston
Motivator

You can do this using advanced XML. Basically set your dashboard up using a HiddenSavedSearch or some other search module, then set each of your panels to use a HiddenPostProcess to render each of your charts using the data from your HiddenSavedSearch. If you don't want to use Advanced XML, I'm not sure there is a way to do this. I'd recommend reading the Developing Advanced Views documentation to get started

If you can use Sideview Utils, you can use the PostProcess module instead of HiddenPostProcess. The Sideview PostProcess module has some extended (and possibly easier to use) functionality, so you may like it better. Nick (the author of Sideview Utils) wrote some very good documentation and introductions to Advanced XML in general and the PostProcess module in particular. Download Sideview Utils and look at its documentation if you can. More information here:

Differences between PostProcess and HiddenPostProcess

Sideview Utils website

0 Karma

wpreston
Motivator

That's good to know. I haven't looked at Simple XML in quite a while but it sounds much more robust now. Thanks for the info!

0 Karma

sowings
Splunk Employee
Splunk Employee

Yes, it's possible to do this in Advanced XML, but many users find the syntax daunting. The capabilities of simple XML have increased significantly over the years, and now this kind of "one search, multiple panels" behavior is possible in simple XML as well.

That being said, advanced XML and Sideview offer a whole wealth of capabilities on their own.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...