Dashboards & Visualizations

How can I pass a token value from a drilldown menu to the scale threshold to change the color of a cell.

usernamejpblais
Engager

In a dashboard I have a drilldown menu to select wich system ID to use. If no system is selected I use all system if there's a selection I use the system selected.

So in a search (makeresults) I passed the value to a token that I use in the scale threshold color to either put green, yellow or red color to the listed cell.

-search-
-query-|makeresults
| eval seuil_TPS=750, pre_seuil_TPS=round(seuil_TPS*0.90,2)
-/query-
-earliest-$sel_date_1.earliest$-/earliest-
-latest-$sel_date_1.latest$-/latest-
-done-
-set token="tok_seuil_TPS">$result.seuil_TPS$-/set-
-set token="tok_pre_seuil_TPS">$result.pre_seuil_TPS$-/set-
-/done-
-/search-

And I use the and in my dashboard as follow:

-format type="color" field="Max Total IMS"
-colorPalette type="list">[#65A637,#F7BC38,#D93F3C]-/colorPalette>
-scale type="threshold">[$tok_pre_seuil_TPS$,$tok_seuil_TPS$]/scale>
-/format>

This work OK.

But when I choose a system my token value doesn't work.
-search>
-query>|makeresults |append [|inputlookup Seuil_lookup]
|where Name=$sel_Name|s$
|eval pre_seuil=round(Seuil*0.90,2)
|table Sys_name, pre_seuil, Seuil
-earliest>0-/earliest>
-sampleRatio>1-/sampleRatio>
-done>
-set token="tok_sel_Sys_name">$result.Sys_name$
-set token="tok_sel_Seuil">$result.Seuil$
-set token="tok_sel_pre_seuil">$result.pre_seuil$
-/done>
-/search>

-format type="color" field="Max $sel_Name$">
-colorPalette type="list">[#65A637,#F7BC38,#D93F3C]-/colorPalette>
-scale type="threshold">[$tok_sel_pre_seuil$,$tok_sel_seuil$]-/scale>
-/format>

I need help Please.
Thx!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...