When you run a standard search query (say, in verbose mode), it auto-extracts fields and displays them on the left. When you click on them you get a mini-dashboard panel that tells you a lot of useful information.
Is there a way to save that mini-dashboard (or be able to convert it to a query) so that I can save it to a named dashboard?
(Btw, I realize that you can click on the items in the mini-dashboard to drill into it but I don't just want the drill-down info…)
Thanks!
Those things are built using the top
and rare
commands but this is a nice ER
request so I would file a P1
with support.
When you say mini-dashboard, are you referring to the prompt display panel you get when you click on a field on the left hand side?
This display panel gives you the option to use different commands such as top values or values displayed by time. So the answer is yes, you can build a dashboard with these queries in it. You can create a single dashboard that shows multiple panels representing different ways of seeing your data.
You can run the search and select the field, then select the TOP
command first.. This will update your exisitng query too look like this
index=blah sourceetype=blah | top FIELD_NAME limit=10
You then select Save-as
in the upper right corner and select a new or existing dashboard.