Splunk Search

One search to source multiple dashboard tables

Communicator

Couldn't see to find a question like this here, but maybe my search for it is no good.

What I'd like to do is have a single search run, that could populate multiple tables in a dashboard.

As an example, say I have all my postfix mail logs in an index named 'mail'.

I want to have a dashboard with three panels, each populated with the output of the below three searches:

index=mail earliest=-24h | top client
index=mail earliest=-24h | top to
index=mail earliest=-24h | top from

Is there a way to get at the data by only running the search once and manipulating the top outputs, instead of taking the resource cost of running that three separate times (one for each top output needed)?

Thanks in advance,

Scott

Tags (2)
1 Solution

Path Finder
0 Karma

Path Finder
0 Karma

Communicator

Fantastic, thanks!

Scott

0 Karma