Splunk 7.x Quick Start Guide

Adding a new panel with inline search

Adding a new panel to the existing dashboard is fairly straightforward. Starting within the existing dashboard, You can create a new panel from scratch by going through the following steps:

1. Click Edit | + Add Panel | New
2. Select a visualization –Line Chart
3. Select the Time-Range options: Use time picker and select Last 60 minutes
4. Provide a title: Throughput by Series
5. Enter the SPL search string (see the following code block)
6. Click Add to Dashboard

This creates a simple line chart panel–the search SPL is shown in the following code:

index=_internal sourcetype=splunkd source=*metrics.log group="per_sourcetype_thruput" series=splunkd| timechart span=5m avg(kbps) as avg_kbps, max(kbps) as max_kbps, perc95(kbps) ...