Splunk Search

How to combine the results of multiple searches in a single table or panel?

JohnBelliveau
New Member

I'm trying to create a dashboard panel with a statistics table, which needs to be populated with the results from multiple searches.
I have searches which will populate each row of a table, which would look something like:

               Tested Limit     Historical Peak     Headroom     Today's Peak
Requests/s        20,000            10,000            100%           8,972 
Responses/s      120,000            20,000            600%          12,899

Obviously, the formatting of the results would be easier if the results could be obtained using a single search, but this is not the case. I would prefer having to avoid creating a custom dashboard just for this, so I'm looking for an alternate approach.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @JohnBelliveau,
Here's an older post on Answers addressing what sounds like a similar question--using multiple searches in a single table. There are a couple of different options, depending on how your event data is structured and the searches you want to run for the table:
https://answers.splunk.com/answers/66473/multiple-search-output-in-a-single-table-list-something.htm...

One suggestion in the above post is to use the appendcols command to append fields from subsearches. Here are some examples in our documentation:
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Appendcols#Examples

You could also check out the Dashboard Examples app to get some ideas. In particular, the "Multi-Search Management" example might help:
https://splunkbase.splunk.com/app/1603/

Hope this helps! Let me know if you need more suggestions,
@frobinson_splunk

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...