Dashboards & Visualizations

How to display both chart and statistics table on dashboard without two separate panels and searches?

irfans
Explorer

Is there a way to display both chart and statistics table on a dashboard without adding two separate panels and running the same search twice?
I know you can flip back and forth between the chart and stats table but what if I want to display both ?

nfilippi_splunk
Splunk Employee
Splunk Employee

I assume that you are running Splunk 6.1, and if so, you can use the following to satisfy your use case here:

  • panel object to group your chart and table element into the same "box" on a dashboard
  • searchTemplate in the global space in order to run a single background search to drive multiple visualizations

Neither of these 2 functions are available in the viz editor, so you will need to edit your Simple XML directly from the xml editor.

It should look something like this:

<dashboard>
   <label>Single Panel Dashboard</label>
   <description/>
   <searchTemplate>index=_internal | top sourcetype</searchTemplate>
   <earliestTime>-60m</earliestTime>
   <latestTime>now</latestTime>
   <row>
     <panel>
       <chart>
         <title>myChart</title>
       </chart>
       <table>
         <title>myTable</title>
       </table>
     </panel>
  </row>
</dashboard>

irfans
Explorer

We are running Splunk version 6.0 , so far I am making dashboard in simple XML but I don't want mind learning Advanced XML if they are the way to go.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Splunk version?? Simple Xml or Advanced xml?

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

One option that may satisify your needs is to use sparklines to add time based detail to your tables:

Spark lines

If you do end up adding two panels but you want one search to drive them, you would use a simple xml feature called search templates.

The docs are located here for search templates.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...