All Apps and Add-ons

Use token or dymanic value in unit parameter of single value panel

splunkdivya
Explorer

Hey Splunkers,

I am using Splunk 6.6.5, It has Unit option in single value. But I need to make this unit dynamic.
I am calculating success and total in the panel. I need to show success as main single value and total in the unit field.

Is this possible or do I need two panels: one for success and one for total. Though I would like to see the former if possible.

Best,

0 Karma
1 Solution

niketn
Legend

@splunkdivya, you can handle this within SPL or through <search> event handler to set a dynamic token for Total.

alt text

Following is a run anywhere example for both options:

<dashboard>
  <label>Single value Success and Total</label>
  <row>
    <panel>
      <single>
        <title>Option 1: Using Token</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats count as Total count(eval(log_level="INFO")) as Success
| table Success Total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$==0">
              <set token="tokTotal">0</set>
            </condition>
            <condition>
              <set token="tokTotal">$result.Total$</set>
            </condition>
          </progress>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">($tokTotal$)</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
      <single>
        <title>Option 2: Using SPL</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats count as Total count(eval(log_level="INFO")) as Success
| eval Success= Success. "(".Total.")"
| table Success</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@splunkdivya, you can handle this within SPL or through <search> event handler to set a dynamic token for Total.

alt text

Following is a run anywhere example for both options:

<dashboard>
  <label>Single value Success and Total</label>
  <row>
    <panel>
      <single>
        <title>Option 1: Using Token</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats count as Total count(eval(log_level="INFO")) as Success
| table Success Total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$==0">
              <set token="tokTotal">0</set>
            </condition>
            <condition>
              <set token="tokTotal">$result.Total$</set>
            </condition>
          </progress>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">($tokTotal$)</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
      <single>
        <title>Option 2: Using SPL</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| stats count as Total count(eval(log_level="INFO")) as Success
| eval Success= Success. "(".Total.")"
| table Success</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

impurush
Contributor

Hi, I tried this code on my dashboard.

When I put the token in my SPL query, the toke is working fine but when I use the same token in the units, it doesn't display the value, instead, it is displaying the token itself.

Could you please help with this.

0 Karma

calcometer
Explorer

Yes, I also have the token-display-one problem. But your can set toke in the title

0 Karma

cmerriman
Super Champion

can you share the query for the value and the success? I believe you can use a token in the unit, but i might need to do some testing.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...