dashboard with two searches each for two panels

0range · ‎03-26-2014

Hello!
I got a question: everywhere in docs it is supposed that I want to make a whole dashboard run from a single search, but if I want to separate a dashboard into, for example, two hidden searches - what should I use?

somesoni2 · ‎03-27-2014

You can try this workaround (not tested)

<form>
 <label>Two Template Search</label>
 <description/>
 <fieldset submitButton="false" autoRun="true">
 <input type="text" token="varFirstSearch" id="field1" searchWhenChanged="true">
  <default>Your First Search Tempate query</default>
 </input>
 <input type="text" token="varSecondSearch" id="field2" searchWhenChanged="true">
 <default>Your Second Search TEmplate query</default>
 </input>
 <html id="field3">
 <body>
 <html>
 <style>.input#field1,.input#field2 { display:none; }</style>
 </html>
 </fieldset>
 <row>
 <table id="master">
  <title>First Search-Table</title>
  <searchString>$varFirstSearch$</searchString>
 </table>
 <chart>
  <title>First Search-Chart</title>
  <searchString>
$varFirstSearch$    
  </searchString>
  <earliestTime>-1w</earliestTime>
  <latestTime>-1d</latestTime>
  <option name="height">200px</option>
  <option name="charting.chart">line</option>
</chart>
<chart>
  <title>Second Search-Chart</title>
  <searchString>
    $varSecondSearch$
  </searchString>
  <earliestTime>-1w</earliestTime>
  <latestTime>-1d</latestTime>
  <option name="height">200px</option>
  <option name="charting.chart">line</option>
</chart>
</row>
</form>

somesoni2 · ‎03-27-2014

Nothing that I am aware of in simple xml.

0range · ‎03-27-2014

Did not try, but it's a workaround. Good, but isn't there any default features?

0range · ‎03-27-2014

Simple is better.
I have a question about putting search template into the chart - it the same to make just a search ? How does it work?

somesoni2 · ‎03-26-2014

Simple Xml or advanced xml? You may wanna look at following post:
http://answers.splunk.com/answers/67358/calling-multiple-search-templates-in-a-form

dashboard with two searches each for two panels

Introducing Splunk Enterprise 9.2

Adoption of RUM and APM at Splunk

Routing logs with Splunk OTel Collector for Kubernetes