Splunk Search

How to create multiple value in single panel?

jaibalaraman
Path Finder

Hi Team 

How to create multiple value in single panel dashboard. 

 

jaibalaraman_0-1656457099973.png

 

Tags (1)
0 Karma

jaibalaraman
Path Finder

Hi 

Sorry i am bit confused , I have 4 different search string which i would like to bring together in single panel. How can i do in trellis. 

Could you please advice on this . 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Don't be confused, just use the first row example where each element uses a separate <single> configuration inside the one panel.

You could theoretically do it in trellis by combining all the searches, but there would be little point.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Two ways - either as distinct single value elements in a single panel or as a trellis view of multiple results for a single element in a single panel.

See example dashboard - first row has 4 <single> elements in a single panel and second has a trellis view of 4 values

<dashboard>
  <label>tst1</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval value=100</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </single>
      <single>
        <search>
          <query>| makeresults
| eval value=200</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </single>
      <single>
        <search>
          <query>| makeresults
| eval value=300</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </single>
      <single>
        <search>
          <query>| makeresults
| eval value=400</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval value1=random() % 100
| eval value2=random() % 100
| eval value3=random() % 100
| eval value4=random() % 100</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
      </single>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...