topic Re: Is it possible to reuse dashboard panel output across other panels? in Dashboards & Visualizations

Is it possible to reuse dashboard panel output across other panels?

POR160893 — Wed, 13 Apr 2022 22:04:05 GMT

Hi,

I have a dashboard with a number of panels. However, some panels use the final answers from other panels as inputs for their panel's calculations. I find myself reusing a lot of the existing queries across a number of panels as a result. Is there a more inheritable way to pass output (be it a number) from one panel and make it accessible on another panel? Would tokens be an option or a global variable?

Thanks,
Patrick

Re: Is it possible to reuse dashboard panel output across other panels?

bowesmana — Wed, 13 Apr 2022 23:20:16 GMT

Certainly you can. That's all about base searches and post processing searches

Here's an example dashboard where there is a search defined outside any panel, then two panels, each uses the output from that base search to calculate some new value from the results of the base search.

<dashboard> <label>tmp</label> <search id="base"> <query>| tstats count where index=* by index sourcetype</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <row> <panel> <title>Indexes</title> <single> <search base="base"> <query>| stats dc(index) as indexes</query> </search> <option name="drilldown">none</option> </single> </panel> <panel> <title>Sourcetypes</title> <single> <search base="base"> <query>| stats dc(sourcetype) as sourcetype</query> </search> <option name="drilldown">none</option> </single> </panel> </row> </dashboard>

See this page on searches

https://docs.splunk.com/Documentation/Splunk/8.2.6/Viz/Savedsearches

Note that a base search should always use a transforming command and not just be a list of events. If you do not use a transforming command, then you must always finish the search with a fields statement to control which fields are available to the post processing searches.

Also, any search in any panel can be a base search, just give the search an id and another search can then reference that search with base="..."

Re: Is it possible to reuse dashboard panel output across other panels?

POR160893 — Wed, 13 Apr 2022 23:50:06 GMT

This would be good but I’m not aloud to change the base search in this dashboard. Most of the panels just perform counts under different filtering. What I need to access these individual answers in 2 panels. Could I not assign each individual panel output to a token in a <done> event handler and just access the tokens in the new panel I need?

Re: Is it possible to reuse dashboard panel output across other panels?

bowesmana — Thu, 14 Apr 2022 00:09:08 GMT

Yes, you can also use tokens set in <done> handlers, which you can use in other panels.

This is a simple way of creating your own <html> panels with single values you want from other searches.

This is another example, with a hidden search generating the tokens you want, which are then used in the other two html panels.

<dashboard> <label>tmp</label> <row> <panel depends="$hidden$"> <table> <search id="base"> <query>| tstats count where index=* by index sourcetype | stats dc(index) as index dc(sourcetype) as sourcetype</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <done> <set token="indexes">$result.index$</set> <set token="sourcetypes">$result.sourcetype$</set> </done> </search> </table> </panel> <panel> <html> <h1>$indexes$ Indexes</h1> </html> </panel> <panel> <html> <h1>$sourcetypes$ Sourcetypes</h1> </html> </panel> </row> </dashboard>

Re: Is it possible to reuse dashboard panel output across other panels?

bowesmana — Thu, 14 Apr 2022 00:11:47 GMT

And this <row> element shows you how using makeresults and tokens inside a single panel

<row> <panel> <title>Indexes Using makeresults with token</title> <single> <search> <query> | makeresults | eval value=$indexes$ </query> </search> </single> </panel> <panel> <title>Sourcetypes Using makeresults with token</title> <single> <search> <query> | makeresults | eval value=$sourcetypes$ </query> </search> </single> </panel> </row>

Re: Is it possible to reuse dashboard panel output across other panels?

POR160893 — Thu, 14 Apr 2022 00:16:32 GMT

Perfect, this solved my problem. Thanks and I gave you karma

Re: Is it possible to reuse dashboard panel output across other panels?

POR160893 — Thu, 14 Apr 2022 07:43:52 GMT

Here is my current XML code:
Panel 1, I am setting the query's result to token called "total_tok":
<panel>
<title>Score</title>
<single>
<search base="base">
<query>where ((EDR=1 OR EDR="Exception Approved" OR EDR="Exception Submitted") AND (NGAV=1 OR NGAV="Exception Approved" OR NGAV="Exception Submitted")) |stats count as Compliant
| appendcols [|loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent SRO" events=false |eval edr_compliant=if(EDR=1, "Yes", "No"), ngav_compliant=if(NGAV=1, "Yes", "No") , mcafee_active45d = if(mcafee_active45d=1,"Active","Not Active")
| fields - dell_discovery_mac dell_discovery_ip
| search dell_discovery_host="*" EDR="*" NGAV="*" DeviceOwnerL5Name="*" DeviceOwnerL4Name="*" | search
|stats count as Total
| eval Total = Total]
| eval percent=round((Compliant/Total)*100,2)."%"
| table percent</query>
<done>
<set token="total_tok">$result.percent$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>

Next, on Panel 2, I am simply calling this same token and multiplying i (the calculation is a lot longer in my actual application btw 🙂 )
<panel>
<title>EDR Compliant - Percentage</title>
<single>
<search>
<query>$total_tok$*2</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>

Am I calling the token from Panel 1 incorrectly as Panel 2 just says the following:

Thanks,
Patrick

Re: Is it possible to reuse dashboard panel output across other panels?

POR160893 — Thu, 14 Apr 2022 07:44:52 GMT

Many thanks,
Patrick