Archive

How Can I make output from dashboard panel to be input to another dashboard panel ?

Explorer

I have a search like below displayed in a panel,
|inputlookup COA_table.csv | BALANCE_TYPE=YTD
eval Net_Profit = X +Y
| table Net_Profit

I want to add the output from this panel to be input for another search in another panel to make search like below

|inputlookup COA_table.csv | BALANCE_TYPE=SOR
eval Partner = D + T + $Net_Profit $

Tags (1)
0 Karma

Esteemed Legend

In the generating panel add this:

<done>
  <set token="GENERATOR_SID">"$job.sid$"</set>
</done>

Then in the consuming panel do this:

  <table depends="$GENERATOR_SID$">
    <title>Splunk is fun</title>
    <search>
      <query>|loadjob $GENERATOR_SID$ | other stuff here</query>

You will also need to add this somewhere appropriate:

<init>
  <unset token="GENERATOR_SID"></unset>
</init>
0 Karma

Legend

Without snippet of your current dashboard's Simple XML, here is how you can pass on token from one Panel to Another in the Same Dashboard. Since we are using $result.<fieldName>$ token to pass on the value of a field from the search to another, the pre-requisite is that the first search must return only single row (I have used | head 1 to ensure the same).

PS: progress and done search event handlers in 6.6 can be used to access $result.Net_Profit$ from first search.
job.resultCount is used to default the value to 0 in case search returns no results. Token $tok_NetProfit$ set in progress event handler can be reused in the second search.

<row>
   <panel>
     <single>
        <search>
            <query>| inputlookup COA_table.csv 
| search  BALANCE_TYPE="YTD"
| table Net_Profit
| head 1
            </query>
            <earliest>@d</earliest><!-- Use your own Time Token-->
            <latest>now</latest><!-- Use your own Time Token-->
            <progress>
                 <condition match="$job.resultCount$==0">
                        <set token="tok_NetProfit">0</set>
                 </condition>
                 <condition>
                        <set token="tok_NetProfit">$result.Net_Profit$</set>
                 </condition>
            </progress>
        </search>
      </single>
    </panel>
    <panel>
         <single>
             <search>
                  <query>| inputlookup COA_table.csv 
| search BALANCE_TYPE="SOR"
| eval Partner = D + T + $tok_NetProfit$
                  </query>
                  <earliest>@d</earliest><!-- Use your own Time Token-->
                  <latest>now</latest><!-- Use your own Time Token-->
             </search>
         </single>
    </panel>
<row>

PS: Refer to documentation for details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#progress

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Legend

Is Net_Profit result from first query a single value, or can it contain multiple rows?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

it's result is single value, but it generated from another equation

0 Karma

Legend

Can you also add what Kind of visualization you are using in Dashboard 1 with table Net_Profit ?
Are you using table? or Single Value visualization? Also which version of Splunk are you on?

In any case you can create a drilldown from visualiation in Dashboard 1 to link to dashboard 2. You can refer to Contextual Drilldown example in Splunk 6.x Dashboard Examples app. However, depending the visualization the token to be passed might change.

You can also refer to Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownLinkToDashboard

PS: Since drilldown event handling has changed in 6.6 please make sure you select correct Splunk Enterprise version in the documentation.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

am using splunk 6.6

Net_Profit is a single value,, anyway i need this value involved automatically in the search without any action

|inputlookup COA_table.csv | BALANCE_TYPE=SOR
eval Partner = D + T + $Net_Profit $

0 Karma

Legend

May be it is unclear from the Question... But are both panels in the same dashboard? Then this would be doable without any action.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

yes in the same dashboard,, and i need its value to be integrated in the second search automatically

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!