Splunk Search

Save auto-extracted fields' mini-dashboards from verbose search as named dashboard panels

chinchin96
New Member

When you run a standard search query (say, in verbose mode), it auto-extracts fields and displays them on the left. When you click on them you get a mini-dashboard panel that tells you a lot of useful information.

Is there a way to save that mini-dashboard (or be able to convert it to a query) so that I can save it to a named dashboard?

(Btw, I realize that you can click on the items in the mini-dashboard to drill into it but I don't just want the drill-down info…)

Thanks!

Tags (3)
0 Karma

woodcock
Esteemed Legend

Those things are built using the top and rare commands but this is a nice ER request so I would file a P1 with support.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

When you say mini-dashboard, are you referring to the prompt display panel you get when you click on a field on the left hand side?

This display panel gives you the option to use different commands such as top values or values displayed by time. So the answer is yes, you can build a dashboard with these queries in it. You can create a single dashboard that shows multiple panels representing different ways of seeing your data.

You can run the search and select the field, then select the TOP command first.. This will update your exisitng query too look like this
index=blah sourceetype=blah | top FIELD_NAME limit=10

You then select Save-as in the upper right corner and select a new or existing dashboard.

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...