Splunk Search
Highlighted

1 saved search for 2 panels

Communicator

Hi.
I have a dashboard with two panels (PC- and mobile site visits, for example, and they are divided by field src [src=mob vs. src=NULL]). I want to make ONE saved search that aggregates all needed data for both searches and then divide the data by the values of parameter "src" to show onto this panels.
How can I do this?

Highlighted

Re: 1 saved search for 2 panels

Motivator

You can do this using advanced XML. Basically set your dashboard up using a HiddenSavedSearch or some other search module, then set each of your panels to use a HiddenPostProcess to render each of your charts using the data from your HiddenSavedSearch. If you don't want to use Advanced XML, I'm not sure there is a way to do this. I'd recommend reading the Developing Advanced Views documentation to get started

If you can use Sideview Utils, you can use the PostProcess module instead of HiddenPostProcess. The Sideview PostProcess module has some extended (and possibly easier to use) functionality, so you may like it better. Nick (the author of Sideview Utils) wrote some very good documentation and introductions to Advanced XML in general and the PostProcess module in particular. Download Sideview Utils and look at its documentation if you can. More information here:

Differences between PostProcess and HiddenPostProcess

Sideview Utils website

0 Karma
Highlighted

Re: 1 saved search for 2 panels

Splunk Employee
Splunk Employee

Yes, it's possible to do this in Advanced XML, but many users find the syntax daunting. The capabilities of simple XML have increased significantly over the years, and now this kind of "one search, multiple panels" behavior is possible in simple XML as well.

That being said, advanced XML and Sideview offer a whole wealth of capabilities on their own.

0 Karma
Highlighted

Re: 1 saved search for 2 panels

Motivator

That's good to know. I haven't looked at Simple XML in quite a while but it sounds much more robust now. Thanks for the info!

0 Karma
Highlighted

Re: 1 saved search for 2 panels

Splunk Employee
Splunk Employee

I'm assuming you're using the simple XML format.

This format permits the use of a single search string driving multiple panels. This is done with the main body of the search being enclosed in a searchTemplate element. Any other panel which needs to modify this search can do so with a searchPostProcess element. This acts like a | <rest of search> phrase would be when executed in the search bar. A brief example follows:


<form>
<searchTemplate>index=site_visits</searchTemplate>
<fieldset>
<input type="time"/>
</fieldset>
<row>
<chart>
<title>Mobile visits over time</title>
<searchPostProcess>search src=mob | timechart count<searchPostProcess>
</chart>
<chart>
<title>PC visits over time</title>
<searchPostProcess>where isnull(src) | timechart count<searchPostProcess>
</chart>
</row>
</form>