Dashboards & Visualizations

How Can I make output from dashboard panel to be input to another dashboard panel ?

MAShawky
Explorer

I have a search like below displayed in a panel,
|inputlookup COA_table.csv | BALANCE_TYPE=YTD
eval Net_Profit = X +Y
| table Net_Profit

I want to add the output from this panel to be input for another search in another panel to make search like below

|inputlookup COA_table.csv | BALANCE_TYPE=SOR
eval Partner = D + T + $Net_Profit $

Tags (1)
0 Karma

woodcock
Esteemed Legend

In the generating panel add this:

<done>
  <set token="GENERATOR_SID">"$job.sid$"</set>
</done>

Then in the consuming panel do this:

  <table depends="$GENERATOR_SID$">
    <title>Splunk is fun</title>
    <search>
      <query>|loadjob $GENERATOR_SID$ | other stuff here</query>

You will also need to add this somewhere appropriate:

<init>
  <unset token="GENERATOR_SID"></unset>
</init>

niketn
Legend

Without snippet of your current dashboard's Simple XML, here is how you can pass on token from one Panel to Another in the Same Dashboard. Since we are using $result.<fieldName>$ token to pass on the value of a field from the search to another, the pre-requisite is that the first search must return only single row (I have used | head 1 to ensure the same).

PS: progress and done search event handlers in 6.6 can be used to access $result.Net_Profit$ from first search.
job.resultCount is used to default the value to 0 in case search returns no results. Token $tok_NetProfit$ set in progress event handler can be reused in the second search.

<row>
   <panel>
     <single>
        <search>
            <query>| inputlookup COA_table.csv 
| search  BALANCE_TYPE="YTD"
| table Net_Profit
| head 1
            </query>
            <earliest>@d</earliest><!-- Use your own Time Token-->
            <latest>now</latest><!-- Use your own Time Token-->
            <progress>
                 <condition match="$job.resultCount$==0">
                        <set token="tok_NetProfit">0</set>
                 </condition>
                 <condition>
                        <set token="tok_NetProfit">$result.Net_Profit$</set>
                 </condition>
            </progress>
        </search>
      </single>
    </panel>
    <panel>
         <single>
             <search>
                  <query>| inputlookup COA_table.csv 
| search BALANCE_TYPE="SOR"
| eval Partner = D + T + $tok_NetProfit$
                  </query>
                  <earliest>@d</earliest><!-- Use your own Time Token-->
                  <latest>now</latest><!-- Use your own Time Token-->
             </search>
         </single>
    </panel>
<row>

PS: Refer to documentation for details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#progress

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

Is Net_Profit result from first query a single value, or can it contain multiple rows?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MAShawky
Explorer

it's result is single value, but it generated from another equation

0 Karma

niketn
Legend

Can you also add what Kind of visualization you are using in Dashboard 1 with table Net_Profit ?
Are you using table? or Single Value visualization? Also which version of Splunk are you on?

In any case you can create a drilldown from visualiation in Dashboard 1 to link to dashboard 2. You can refer to Contextual Drilldown example in Splunk 6.x Dashboard Examples app. However, depending the visualization the token to be passed might change.

You can also refer to Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownLinkToDashboard

PS: Since drilldown event handling has changed in 6.6 please make sure you select correct Splunk Enterprise version in the documentation.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MAShawky
Explorer

am using splunk 6.6

Net_Profit is a single value,, anyway i need this value involved automatically in the search without any action

|inputlookup COA_table.csv | BALANCE_TYPE=SOR
eval Partner = D + T + $Net_Profit $

0 Karma

niketn
Legend

May be it is unclear from the Question... But are both panels in the same dashboard? Then this would be doable without any action.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MAShawky
Explorer

yes in the same dashboard,, and i need its value to be integrated in the second search automatically

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...