Dashboards & Visualizations

Access search field for Dashboard title

DerekKing
Path Finder

Hi All,

I have a search that results in 2 fields, that I would like to use as a single value field in my dashboard, and access the second field as a token to be used in either the panel title, or the single value caption.

As an example - My search ends like

| stats count values(fileName) AS fileName

which results in;
count | fileName
31 | derek.txt

Is there a way to access the filename field as a token? I thought I may just be able to use $result.fileName$, but it appears not. I've also tried $result.fileName$ and then using that as my token in the title, but no joy.

To give you an idea, currently my XML looks like

  <title>$result.fileName$</title>
  <single>
    <title></title>
    <search>
      <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">block</option>
    <option name="drilldown">none</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="unitPosition">after</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
    <option name="rangeValues">[0,30,70,100]</option>
    <option name="linkView">search</option>
    <option name="underLabel">$fileName$</option>
  </single>
</panel>

Any thoughts, appreciated.

Derek

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

Try the following, where you have to add a little extra to the <search> element to get the fields. See this link for more details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

Also, your search will currently give you a multi-valued set for fileName (because you use values()). Do you want the single fileName value with the most number of processCount? If so, I would change the search to the following:

search .... | stats sum(processCount) AS Processed by fileName | sort 1 -fileName

  <panel>
  <title>$title$</title>
   <single>
     <search>
       <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query>
       <done>
        <condition match=" 'job.resultCount' > 0">
            <set token="title">$result.fileName$</set>
            <set token="label">$result.fileName$</set>
        </condition>
        <condition>
            <set token="title">"No Data"</set>
            <set token="label">"No Data"</set>
        </condition>
    </done>
     </search>
     <option name="colorBy">value</option>
     <option name="colorMode">block</option>
     <option name="drilldown">none</option>
     <option name="numberPrecision">0</option>
     <option name="showSparkline">1</option>
     <option name="showTrendIndicator">1</option>
     <option name="trendColorInterpretation">standard</option>
     <option name="trendDisplayMode">absolute</option>
     <option name="unitPosition">after</option>
     <option name="useColors">1</option>
     <option name="useThousandSeparators">1</option>
     <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
     <option name="rangeValues">[0,30,70,100]</option>
     <option name="underLabel">$label$</option>
   </single>
 </panel>

View solution in original post

rjthibod
Champion

Try the following, where you have to add a little extra to the <search> element to get the fields. See this link for more details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

Also, your search will currently give you a multi-valued set for fileName (because you use values()). Do you want the single fileName value with the most number of processCount? If so, I would change the search to the following:

search .... | stats sum(processCount) AS Processed by fileName | sort 1 -fileName

  <panel>
  <title>$title$</title>
   <single>
     <search>
       <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query>
       <done>
        <condition match=" 'job.resultCount' > 0">
            <set token="title">$result.fileName$</set>
            <set token="label">$result.fileName$</set>
        </condition>
        <condition>
            <set token="title">"No Data"</set>
            <set token="label">"No Data"</set>
        </condition>
    </done>
     </search>
     <option name="colorBy">value</option>
     <option name="colorMode">block</option>
     <option name="drilldown">none</option>
     <option name="numberPrecision">0</option>
     <option name="showSparkline">1</option>
     <option name="showTrendIndicator">1</option>
     <option name="trendColorInterpretation">standard</option>
     <option name="trendDisplayMode">absolute</option>
     <option name="unitPosition">after</option>
     <option name="useColors">1</option>
     <option name="useThousandSeparators">1</option>
     <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
     <option name="rangeValues">[0,30,70,100]</option>
     <option name="underLabel">$label$</option>
   </single>
 </panel>

Gayatri
Engager

Hi,

@rjthibod will this work in Splunk version 7.6.0, because I have tried it but it still displays $label$ instead of value. Below is my query where I want to fetch TraWeek and should get used as under label in single value chart. Please help me to achieve this.

<row>
<panel>
<title>Transaction points processed</title>
<single>
<search>
<query>index=* sourcetype=member.csv |dedup TraWeek | eventstats max(TraWeek) as Max_TransWeek|where TraWeek=Max_TransWeek|eval PAM1=round(PointsAmountInMillion,2)|timechart latest(PAM1) as TransactionPoints by TraWeek</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
<done>
<condition match=" 'job.resultCount' > 0">
<set token="title">$result.TraWeek$</set>
<set token="label">$result.TraWeek$</set>
</condition>
<condition>
<set token="title">"No Data"</set>
<set token="label">"No Data"</set>
</condition>
</done>
</search>
<option name="drilldown">all</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="underLabel">$label$</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="unit">M</option>
<option name="underLabel">$label$</option>
</single>
</panel>

0 Karma

DerekKing
Path Finder

Brilliant Thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...