How Can I make output from dashboard panel to be input to another dashboard panel ?

[MAShawky]

I have a search like below displayed in a panel,
|inputlookup COA_table.csv | BALANCE_TYPE=YTD
eval Net_Profit = X +Y
| table Net_Profit

I want to add the output from this panel to be input for another search in another panel to make search like below

|inputlookup COA_table.csv | BALANCE_TYPE=SOR
eval Partner = D + T + $Net_Profit $

[woodcock]

In the generating panel add this:

<done>
  <set token="GENERATOR_SID">"$job.sid$"</set>
</done>

Then in the consuming panel do this:

  <table depends="$GENERATOR_SID$">
    <title>Splunk is fun</title>
    <search>
      <query>|loadjob $GENERATOR_SID$ | other stuff here</query>

You will also need to add this somewhere appropriate:

<init>
  <unset token="GENERATOR_SID"></unset>
</init>

[niketn]

Without snippet of your current dashboard's Simple XML, here is how you can pass on token from one Panel to Another in the Same Dashboard. Since we are using $result.<fieldName>$ token to pass on the value of a field from the search to another, the pre-requisite is that the first search must return only single row (I have used | head 1 to ensure the same).

PS: progress and done search event handlers in 6.6 can be used to access $result.Net_Profit$ from first search.
job.resultCount is used to default the value to 0 in case search returns no results. Token $tok_NetProfit$ set in progress event handler can be reused in the second search.

<row>
   <panel>
     <single>
        <search>
            <query>| inputlookup COA_table.csv 
| search  BALANCE_TYPE="YTD"
| table Net_Profit
| head 1
            </query>
            <earliest>@d</earliest><!-- Use your own Time Token-->
            <latest>now</latest><!-- Use your own Time Token-->
            <progress>
                 <condition match="$job.resultCount$==0">
                        <set token="tok_NetProfit">0</set>
                 </condition>
                 <condition>
                        <set token="tok_NetProfit">$result.Net_Profit$</set>
                 </condition>
            </progress>
        </search>
      </single>
    </panel>
    <panel>
         <single>
             <search>
                  <query>| inputlookup COA_table.csv 
| search BALANCE_TYPE="SOR"
| eval Partner = D + T + $tok_NetProfit$
                  </query>
                  <earliest>@d</earliest><!-- Use your own Time Token-->
                  <latest>now</latest><!-- Use your own Time Token-->
             </search>
         </single>
    </panel>
<row>

PS: Refer to documentation for details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#progress

[niketn]

Is Net_Profit result from first query a single value, or can it contain multiple rows?

[MAShawky]

it's result is single value, but it generated from another equation

[niketn]

Can you also add what Kind of visualization you are using in Dashboard 1 with table Net_Profit ?
Are you using table? or Single Value visualization? Also which version of Splunk are you on?

In any case you can create a drilldown from visualiation in Dashboard 1 to link to dashboard 2. You can refer to Contextual Drilldown example in Splunk 6.x Dashboard Examples app. However, depending the visualization the token to be passed might change.

You can also refer to Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownLinkToDashboard

PS: Since drilldown event handling has changed in 6.6 please make sure you select correct Splunk Enterprise version in the documentation.

[MAShawky]

am using splunk 6.6

Net_Profit is a single value,, anyway i need this value involved automatically in the search without any action

|inputlookup COA_table.csv | BALANCE_TYPE=SOR
eval Partner = D + T + $Net_Profit $

[niketn]

May be it is unclear from the Question... But are both panels in the same dashboard? Then this would be doable without any action.

[MAShawky]

yes in the same dashboard,, and i need its value to be integrated in the second search automatically