Dashboards & Visualizations

Best way to add multiple(30+) panels to a splunk dashboard

HattrickNZ
Motivator

What is the Best way to add multiple panels to a splunk dashboard?

I currently have a dashboard where I want to add 30+ panels which are just very simple timecharts for the last 24 hours.

I have all the searches and titles I want like this

search title 
index=*... title1
...
index=*... title30

The best way I can think of is to just add them individually
1 - Edit dashborad - Add panel (copy paste search and title), Add panel .... repeat.
2 - Use XML - Create 1 panel, copy and paste this panel X times and then edit accordingly.

Is there a better way than this very repetitive task?

0 Karma

cmerriman
Super Champion

Are you using the same search over and over again except only changing a small aspect of it in each panel? If so, instead of opening 30 searches, you might want to use post-process.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/Savedsearches#Post-process_searches_2
Otherwise, my easiest suggestion would be to build the first panel, copy the xml source code, paste and edit. Repeat. It’s quicker to make small changes in a search string in the source code when you need to do it over and over and over.

HattrickNZ
Motivator

tks I'll have a look at that.

I am olnly changing the KPI
index=... | timechart span=5m sum(KPI1) by device
...
index=... | timechart span=5m sum(KPI30) by device

I'll probs copy and paste the xml and edit in a editor as I find the splunk one probably not the best for this scenario.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...