Dashboards & Visualizations

How can I pass a token value from a drilldown menu to the scale threshold to change the color of a cell.

usernamejpblais
Engager

In a dashboard I have a drilldown menu to select wich system ID to use. If no system is selected I use all system if there's a selection I use the system selected.

So in a search (makeresults) I passed the value to a token that I use in the scale threshold color to either put green, yellow or red color to the listed cell.

-search-
-query-|makeresults
| eval seuil_TPS=750, pre_seuil_TPS=round(seuil_TPS*0.90,2)
-/query-
-earliest-$sel_date_1.earliest$-/earliest-
-latest-$sel_date_1.latest$-/latest-
-done-
-set token="tok_seuil_TPS">$result.seuil_TPS$-/set-
-set token="tok_pre_seuil_TPS">$result.pre_seuil_TPS$-/set-
-/done-
-/search-

And I use the and in my dashboard as follow:

-format type="color" field="Max Total IMS"
-colorPalette type="list">[#65A637,#F7BC38,#D93F3C]-/colorPalette>
-scale type="threshold">[$tok_pre_seuil_TPS$,$tok_seuil_TPS$]/scale>
-/format>

This work OK.

But when I choose a system my token value doesn't work.
-search>
-query>|makeresults |append [|inputlookup Seuil_lookup]
|where Name=$sel_Name|s$
|eval pre_seuil=round(Seuil*0.90,2)
|table Sys_name, pre_seuil, Seuil
-earliest>0-/earliest>
-sampleRatio>1-/sampleRatio>
-done>
-set token="tok_sel_Sys_name">$result.Sys_name$
-set token="tok_sel_Seuil">$result.Seuil$
-set token="tok_sel_pre_seuil">$result.pre_seuil$
-/done>
-/search>

-format type="color" field="Max $sel_Name$">
-colorPalette type="list">[#65A637,#F7BC38,#D93F3C]-/colorPalette>
-scale type="threshold">[$tok_sel_pre_seuil$,$tok_sel_seuil$]-/scale>
-/format>

I need help Please.
Thx!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...