Can the same data returned from a search be used to populate both a table and a graph?

[RVDowning]

Can the same data returned from a search be used to populate both a table and a graph?

[yannK]

Same version in simple XML


<searchTemplate>index=_internal | bucket _time span=1h | stats count by _time source log_level</searchTemplate>
<row>
<table>
<searchPostProcess>timechart count by source</searchPostProcess>
</table>
</row>
<row>
<chart>
<searchPostProcess>timechart count by source</searchPostProcess>
</chart>
</row>


[yannK]

Please accept the answer to mark the question as resolved.

[RVDowning]

Thanks much! That did the trick.

[kristian_kolb]

http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/PostProcess

[strive]

I am not sure if it is possible with Simple XML. I have given example for advanced xml. Let me try if it is possible with simple xml

[RVDowning]

Probably simple unless advanced is needed, and so far the requirements don't seem to require advanced.

[strive]

Here is the sample

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="DashboardName">
<param name="search">`Search_Macro`</param>
<module name="ViewstateAdapter">
    <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
            <module name="EnablePreview">
                <param name="enable">True</param>
                <param name="display">False</param>
                <module name="HiddenChartFormatter">
                    <param name="charting.primaryAxisTitle.text">X_Axis_Label</param>
                    <param name="charting.secondaryAxisTitle.text">Y_Axis_Label</param>
                    <param name="charting.legend.labelStyle.overflowMode">ellipsisEnd</param>
                    <param name="charting.tooltip.content.fieldStyle.overflowMode">ellipsisEnd</param>
                    <param name="charting.legend.placement">bottom</param>
                    <param name="charting.chart">line</param>
                    <param name="charting.chart.nullValueMode">gaps</param>
                    <module name="FlashChart">
                        <param name="width">100%</param>
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                    </module>
                    <module name="Paginator">
                        <param name="entityName">results</param>
                        <module name="SimpleResultsTable">
                        </module>
                        <module name="Paginator">
                            <param name="entityName">results</param>
                        </module>
                    </module>
                    <module name="ViewRedirectorLink">
                        <param name="viewTarget">flashtimeline</param>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>
</module>  

Using Simple XML

 <form>
 <label>My Dashboard</label>  
  <searchTemplate>
   index=main sourcetype=jvm_gcdump earliest=-2h@h | bucket _time span=5m | stats avg(HeapSpaceBeforeGC) as BeforeGC avg(HeapSpaceAfterGC) as AfterGC avg(TotalHeapSpace) as TotalHeap by _time
  </searchTemplate>

  <row>
          <chart>
            <title>Line Chart</title>
            <searchPostProcess>timechart first(BeforeGC) first(AfterGC) first(TotalHeap)</searchPostProcess>
             <option name="charting.chart">line</option>
          </chart>
  </row>  
  <row>
          <table>
            <title>Table Chart</title>
            <searchPostProcess>timechart first(BeforeGC) first(AfterGC) first(TotalHeap)</searchPostProcess>
          </table>
  </row> 
</form>

[strive]

for Simple XML refer this link

http://answers.splunk.com/answers/109410/single-search-in-multiple-charts

[strive]

Yes it is possible. Are you using advanced xml or simple xml?