Dashboards & Visualizations

Can I use a field as a token without it showing on the search?

maffreitas
Path Finder

Can I use a field as a token without it showing on the search?

For example:
index=idx_abc sourcetype=src_a TOTAL > 10 | table Col1 Col2 Col3

I want to use $result.TOTAL$. In other words, I want refer to a column without show it on the search results.

Labels (1)
0 Karma

weidertc
Communicator

If you prefix the token name with an underscore it will hide it from the table, but the information is still present for you to use.  You will still need to put it in the final table.

This command will contain the data for all 4 fields, but it will only visibly show you the 3 without leading underscores.

| table _TOTAL Col1 Col2 Col3

This token will be available for you to use.

$result._TOTAL$

grywiner51
Explorer

This is the way.  Thank you weidertc!

0 Karma

cmerriman
Super Champion

Try this (put TOTAL in the table but use under options):

  <row>
    <panel>
      <table>
        <title>TITLE</title>
        <search>
          <query>index=idx_abc sourcetype=src_a TOTAL > 10 | table Col1 Col2 Col3 TOTAL </query>
        <set token="total">$result.TOTAL$</set>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <fields>["Col1","Col2","Col3"]</fields>
      </table>
    </panel>
  </row>
0 Karma

maffreitas
Path Finder

Hi @cmerriman, thank you.

It unfortunately does not work, because if try to use the the $result.TOTAL$ this value comes empty on the email.

0 Karma

cmerriman
Super Champion

you might need to do:

<done>
<set token="total">$result.TOTAL$</set>
</done>

or

<preview>
<set token="total">$result.TOTAL$</set>
</preview>

something to help troubleshoot tokens is to use showtokens.js to see if the token is being created/evaluated correctly.

0 Karma

maffreitas
Path Finder

@cmerriman, thank you again.

I got your point, but by default I can't use simpleXML on email alert notification, can I?
(http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/EmailNotificationTokens)

0 Karma

cmerriman
Super Champion

Sorry, I was thinking through dashboards and not alerts. I think the field has to be available for you to use it in your alert.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...