topic Re: How to pass search result from one Panel to a different Panel? in Splunk Search

How to pass search result from one Panel to a different Panel?

_dave_b — Thu, 24 Mar 2016 14:55:57 GMT

Hello. I'm trying to construct a footer containing my app's version in a dashboard. The footer resides in a different panel. I can find the version from a search, but I haven't found a way to pass that value into the lower panel. It seems like this can be done by using tokens, but my research hasn't revealed a way to do this specifically.

Conceptually, I want the dashboard code to work like this:

Panel1:
<query>| rest /servicesNS/nobody/system/apps/local/ | search title="MyApp" | table title version</query>

Panel2:
< html >< center >< h8 >< img src="/static/app/MyApp/appLogo.png" / > MyApp version $version$< /h8 >< /center >< /html >

Any helpful pointers or references would be greatly appreciated!

Thanks

Re: How to pass search result from one Panel to a different Panel?

somesoni2 — Thu, 24 Mar 2016 15:59:48 GMT

Give this a try (run anywhere sample for Splunk 6.3.x)

<dashboard>
  <label>Token from Search</label> 
  <row>
    <panel>
      <table>
         <search>
          <query>| gentimes start=-1 | eval ReportDate=strftime(now(),"%F %T") | table ReportDate</query>
          <earliest></earliest>
          <latest></latest>
          <done>
            <condition match="'job.resultCount' == 1">
              <set token="rptdate">$result.ReportDate$</set>
            </condition>
             <condition >
               <unset token="rptdate"/>
            </condition>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <center>
          <h8> Today's Date is $rptdate$</h8>
        </center>
      </html>
    </panel>
  </row>
</dashboard>

Re: How to pass search result from one Panel to a different Panel?

_dave_b — Thu, 24 Mar 2016 20:30:37 GMT

I get

Today's Date is $result.ReportDate$

Re: How to pass search result from one Panel to a different Panel?

_dave_b — Thu, 24 Mar 2016 22:17:03 GMT

The problem is the result object isn't de-referencing the ReportDate value as expected. That result object seems key for accessing values from the search.

Re: How to pass search result from one Panel to a different Panel?

daishih — Tue, 09 Aug 2016 14:38:34 GMT

This answer does not work 😞 I get the same result

Today's Date is $result.ReportDate$

Re: How to pass search result from one Panel to a different Panel?

somesoni2 — Tue, 09 Aug 2016 14:44:10 GMT

What version of Splunk are you using?