https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433900#M123874 <P>I am trying to build a panel where I would like to input the source and present in a radial guaze.</P> <P>The simple query looks something like this:</P> <PRE><CODE>index=x host=y source = /logs/zzz* "keyword"| |timechart span=1m count as keyword </CODE></PRE> <P>And in there I want to be able to change the "zzz" to different options as per input. </P> <P>Any advice?</P> Wed, 30 Jan 2019 20:29:19 GMT pranay04 2019-01-30T20:29:19Z https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433900#M123874 <P>I am trying to build a panel where I would like to input the source and present in a radial guaze.</P> <P>The simple query looks something like this:</P> <PRE><CODE>index=x host=y source = /logs/zzz* "keyword"| |timechart span=1m count as keyword </CODE></PRE> <P>And in there I want to be able to change the "zzz" to different options as per input. </P> <P>Any advice?</P> Wed, 30 Jan 2019 20:29:19 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433900#M123874 pranay04 2019-01-30T20:29:19Z https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433901#M123875 <P>Hi @pranay04 </P> <P>To do this you need to edit the dashboard and "add an input". Edit thatinput to set a token called for example "source".</P> <P>Then in your panel, update the search to look like this:</P> <P><CODE>index=x host=y source = $source$* "keyword |timechart span=1m count as keyword</CODE></P> <P>Here is some more info: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens#Using_tokens_in_a_search">https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens#Using_tokens_in_a_search</A></P> <P>Good luck </P> Wed, 30 Jan 2019 21:54:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433901#M123875 chrisyounger 2019-01-30T21:54:22Z https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433902#M123876 <P>Great ! Thanks! got it</P> Thu, 31 Jan 2019 21:07:31 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433902#M123876 pranay04 2019-01-31T21:07:31Z https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433903#M123877 <P>Why not keep them all and use the <CODE>Trellis</CODE> feature?</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis">https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis</A></P> Thu, 31 Jan 2019 23:36:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-build-a-panel-with-different-source-inputs/m-p/433903#M123877 woodcock 2019-01-31T23:36:52Z