Splunk Search

Save auto-extracted fields' mini-dashboards from verbose search as named dashboard panels

chinchin96
New Member

When you run a standard search query (say, in verbose mode), it auto-extracts fields and displays them on the left. When you click on them you get a mini-dashboard panel that tells you a lot of useful information.

Is there a way to save that mini-dashboard (or be able to convert it to a query) so that I can save it to a named dashboard?

(Btw, I realize that you can click on the items in the mini-dashboard to drill into it but I don't just want the drill-down info…)

Thanks!

Tags (3)
0 Karma

woodcock
Esteemed Legend

Those things are built using the top and rare commands but this is a nice ER request so I would file a P1 with support.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

When you say mini-dashboard, are you referring to the prompt display panel you get when you click on a field on the left hand side?

This display panel gives you the option to use different commands such as top values or values displayed by time. So the answer is yes, you can build a dashboard with these queries in it. You can create a single dashboard that shows multiple panels representing different ways of seeing your data.

You can run the search and select the field, then select the TOP command first.. This will update your exisitng query too look like this
index=blah sourceetype=blah | top FIELD_NAME limit=10

You then select Save-as in the upper right corner and select a new or existing dashboard.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...