Splunk Search

Save auto-extracted fields' mini-dashboards from verbose search as named dashboard panels

chinchin96
New Member

When you run a standard search query (say, in verbose mode), it auto-extracts fields and displays them on the left. When you click on them you get a mini-dashboard panel that tells you a lot of useful information.

Is there a way to save that mini-dashboard (or be able to convert it to a query) so that I can save it to a named dashboard?

(Btw, I realize that you can click on the items in the mini-dashboard to drill into it but I don't just want the drill-down info…)

Thanks!

Tags (3)
0 Karma

woodcock
Esteemed Legend

Those things are built using the top and rare commands but this is a nice ER request so I would file a P1 with support.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

When you say mini-dashboard, are you referring to the prompt display panel you get when you click on a field on the left hand side?

This display panel gives you the option to use different commands such as top values or values displayed by time. So the answer is yes, you can build a dashboard with these queries in it. You can create a single dashboard that shows multiple panels representing different ways of seeing your data.

You can run the search and select the field, then select the TOP command first.. This will update your exisitng query too look like this
index=blah sourceetype=blah | top FIELD_NAME limit=10

You then select Save-as in the upper right corner and select a new or existing dashboard.

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...