Use token or dymanic value in unit parameter of single value panel

[splunkdivya]

Hey Splunkers,

I am using Splunk 6.6.5, It has Unit option in single value. But I need to make this unit dynamic.
I am calculating success and total in the panel. I need to show success as main single value and total in the unit field.

Is this possible or do I need two panels: one for success and one for total. Though I would like to see the former if possible.

Best,

[niketn · Accepted solution]

@splunkdivya, you can handle this within SPL or through <search> event handler to set a dynamic token for Total.

Following is a run anywhere example for both options:

<dashboard>
  <label>Single value Success and Total</label>
  <row>
    <panel>
      <single>
        <title>Option 1: Using Token</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats count as Total count(eval(log_level="INFO")) as Success
| table Success Total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$==0">
              <set token="tokTotal">0</set>
            </condition>
            <condition>
              <set token="tokTotal">$result.Total$</set>
            </condition>
          </progress>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">($tokTotal$)</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
      <single>
        <title>Option 2: Using SPL</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats count as Total count(eval(log_level="INFO")) as Success
| eval Success= Success. "(".Total.")"
| table Success</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

[impurush]

Hi, I tried this code on my dashboard.

When I put the token in my SPL query, the toke is working fine but when I use the same token in the units, it doesn't display the value, instead, it is displaying the token itself.

Could you please help with this.

[calcometer]

Yes, I also have the token-display-one problem. But your can set toke in the title

[cmerriman]

can you share the query for the value and the success? I believe you can use a token in the unit, but i might need to do some testing.