Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?
I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:
Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.
It should look something like this:
<dashboard>
<label>Single Panel Dashboard</label>
<description/>
<searchTemplate>index=_internal | top sourcetype</searchTemplate>
<earliestTime>-60m</earliestTime>
<latestTime>now</latestTime>
<row>
<panel>
<chart>
<title>myChart</title>
</chart>
<table>
<title>myTable</title>
</table>
</panel>
</row>
</dashboard>
We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.
Splunk version?? Simple Xml or Advanced xml?
One option that may satisify your needs is to use sparklines to add time based detail to your tables:
If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.
The docs are located here for search templates.