I have two different panels of dashboard as the following
<dashboard>
<label>xmlcheck</label>
<row>
<table>
<searchString><![CDATA[source="FTPLOG.log" "Customer has successfully retrieved file"
| rex "::\s(?<timestamp>\S+)\s"| rex "^\S+\s(?<userid>\S+)\."
| rex "\s(?<file_name>\S+)\s\((?<record_count>\d+)\srecords/(?<byte_count>\d+)\sbytes\)$"
| stats count as FileCount list(file_name) as FileName sum(record_count) as RecordCount sum(byte_count) as ByteCount by timestamp userid
| where RecordCount !=0 AND ByteCount !=0]]>
</searchString>
</table>
</row>
<row>
<table>
<searchString><![CDATA[source="FTPLOG.log"| rex "^\S+\s(?<userid>\w+\.[0-9a-zA-Z]{4})"
| stats distinct_count(userid)]]>
</searchString>
</table>
</row>
</dashboard>
I want to display these two search results in same single panel of a dashboard.
Can anyone help me on this.
There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it.
<dashboard>
<row grouping="2">
<table>
...
</table>
<table>
...
</table>
</row>
</dashboard>
There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row
Also you can check out the Splunk 6 Dashboard Examples App
There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it.
<dashboard>
<row grouping="2">
<table>
...
</table>
<table>
...
</table>
</row>
</dashboard>
There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row
Also you can check out the Splunk 6 Dashboard Examples App
This is really working ,I could get two search results in single panel.Thanks a lot.
Couldn't you just put both
Then the structure would be
<dashboard>
<label>xmlcheck</label>
<row>
<searchstring>your first search</searchstring>
<searchstring>your second search</searchstring>
</row>
</dashboard>
If that doesn't work you might have to use Advanced XML instead. Check out this thread.