Splunk Dashboard

vplunk — Fri, 05 Nov 2021 11:49:59 GMT

Hello Everyone,

I am working on a dashboard with 2 event panel . and i would like to use the outcome of panel 1 as an input to my panel 2 . Can you please advise what is the optimal way to take a specific field output and utilise as an input in the next panel . I tried base search but did not provide result as expected.

Panel 1 :

<query>index=xyz sourcetype=vpn *session*
| fields session, connection_name, DNS, ip_subnet, Location,user
| stats values(connection_name) as connection, values(Dns) as DNS, by session
| join type=inner session
[ search index=abc sourcetype=vpn *Dynamic*
| fields assigned_ip,session | stats values(assigned_ip) as IP by session]
| table User,session,connection_name,ip_subnet,IP,DNS,Location |where user="$field1$" OR connection_name="$field2$" OR session="$field3$"</query>

Once the output is generated for the above query , i would like to leverage the value displayed for Ip_subnet and use that as input for panel 2

Panel 2:

<query>|inputlookup letest.csv
|rename "IP address details" as IP
| xyseries Ip_subnet,Location,IP | where Ip_subnet="$Ip_subnet$"</query>

In panel 2 $Ip_subnet$ is input that would be taken from value of Ip_subnet of panel 1.

Re: Splunk Dashboard

richgalloway — Fri, 05 Nov 2021 12:18:55 GMT

Use a done element to set a token for the 2nd query to use.

...</query> <done> <set token=ip_subnet>$result.ip_subnet$</set> </done>

Remember that field and token names are case-sensitive.

Re: Splunk Dashboard

vplunk — Tue, 09 Nov 2021 11:34:48 GMT

Hello Richgalloway,

Thank you for taking time and responding to my query . Instead of using the set token i went ahead with storing the value in another field ( as a dropdown) and selected from there and that became the input for the next panel.

Regards.

topic Splunk Dashboard in Dashboards & Visualizations

Splunk Dashboard

Re: Splunk Dashboard

Re: Splunk Dashboard