Splunk Search

How to show two search results in one dashboard panel

muthvin
New Member

HI all
I have two search which yield the table like this below:

Module1 Module2

Name1 1.2 2.2
Name2 1.5 3.2
Name3 1.6 4.2
Name4 1.2 5.2
Name5 1.5 6.2
Name6 1.6 7.2

My queries are like: index=_internal module="module1" | stats count by sourcetype and
index=_internal module="module2" | stats count by sourcetype

I want to merge these queries and create a dashboard panel to yield results as in table and line graph with two lines in it.
It will be great if someone help me here!

Thanks.

Tags (2)
0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

Hi muthvin, try this:

index=_internal module="module1" OR module="module2" | chart count over module by sourcetype

View solution in original post

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Hi muthvin, try this:

index=_internal module="module1" OR module="module2" | chart count over module by sourcetype
0 Karma

somesoni2
Revered Legend

I guess the chart command should say this to get sourcetype as rows and module as columns

... | chart count over sourcetype by module 
0 Karma

muthvin
New Member

Thanks guys in my case i reverted module by sourcetype and that solves my problem..

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...