Splunk Search

How to combine the results of multiple searches in a single table or panel?

JohnBelliveau
New Member

I'm trying to create a dashboard panel with a statistics table, which needs to be populated with the results from multiple searches.
I have searches which will populate each row of a table, which would look something like:

               Tested Limit     Historical Peak     Headroom     Today's Peak
Requests/s        20,000            10,000            100%           8,972 
Responses/s      120,000            20,000            600%          12,899

Obviously, the formatting of the results would be easier if the results could be obtained using a single search, but this is not the case. I would prefer having to avoid creating a custom dashboard just for this, so I'm looking for an alternate approach.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @JohnBelliveau,
Here's an older post on Answers addressing what sounds like a similar question--using multiple searches in a single table. There are a couple of different options, depending on how your event data is structured and the searches you want to run for the table:
https://answers.splunk.com/answers/66473/multiple-search-output-in-a-single-table-list-something.htm...

One suggestion in the above post is to use the appendcols command to append fields from subsearches. Here are some examples in our documentation:
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Appendcols#Examples

You could also check out the Dashboard Examples app to get some ideas. In particular, the "Multi-Search Management" example might help:
https://splunkbase.splunk.com/app/1603/

Hope this helps! Let me know if you need more suggestions,
@frobinson_splunk

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...