Dashboards & Visualizations

How do I show results from a panel in another panel?

cmcdole
Path Finder

Here is the layout I'm going for. I need the Availability results from panels 2, 3 and 4 to populate panel 1
|Panel 1
|App1 Availability | App2 Availability | App3 Availability | App4 Availability|
|100% 100% 100% 100% |


|Panel 2 - App2
|Field 1 Field2 Availability
|blah   blah  100%


|Panel 3 - App3
|Field 1 Field2 Availability
|blah   blah  100%


|Panel 4 - App4
|Field 1 Field2 Availability
|blah   blah  100%

Tags (1)
0 Karma
1 Solution

niketn
Legend

@cmcdole, please try the following run anywhere dashboard. <panel2>,<panel3> and <panel4> search queries would need to be replaced with what you currently have in your dashboard (current query with |makeresults in panel 2, 3 and 4 are used to create dummy data as per your question). Each of the three panels will set tokens tokAvailabilityApp2,tokAvailabilityApp3 and tokAvailabilityApp4 respectively.

<panel1> code would need to remain as it is i.e. do not replace the | maekresults command as it creates a search where three App's status is set from their respective tokens.

alt text

Following is the complete Simple XML code for run anywhere dashboard example above. Please try out and confirm:

<dashboard>
  <label>Panel from results of other panels</label>
  <row>
    <panel>
      <title>Panel 1 - All Apps Status</title>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval "App1 Availability"="$tokAvailabilityApp1$","App2 Availability"="$tokAvailabilityApp2$","App3 Availability"="$tokAvailabilityApp3$"
          </query>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Panel 2 - App1</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp1">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App2</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp2">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App3</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp3">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

cmcdole
Path Finder

This worked perfectly. I only had to incorporate my original queries. Thank you so much!!

0 Karma

niketn
Legend

@cmcdole, please try the following run anywhere dashboard. <panel2>,<panel3> and <panel4> search queries would need to be replaced with what you currently have in your dashboard (current query with |makeresults in panel 2, 3 and 4 are used to create dummy data as per your question). Each of the three panels will set tokens tokAvailabilityApp2,tokAvailabilityApp3 and tokAvailabilityApp4 respectively.

<panel1> code would need to remain as it is i.e. do not replace the | maekresults command as it creates a search where three App's status is set from their respective tokens.

alt text

Following is the complete Simple XML code for run anywhere dashboard example above. Please try out and confirm:

<dashboard>
  <label>Panel from results of other panels</label>
  <row>
    <panel>
      <title>Panel 1 - All Apps Status</title>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval "App1 Availability"="$tokAvailabilityApp1$","App2 Availability"="$tokAvailabilityApp2$","App3 Availability"="$tokAvailabilityApp3$"
          </query>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Panel 2 - App1</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp1">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App2</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp2">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App3</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp3">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jrfrost
Explorer

What's the underling search(s) for each panel, is not possible to use the same search and just display the availability field in the first panel

0 Karma

PowerPacked
Builder

Hi @ cmcdole

Use this search in panel2, panel3 & panel4 to get the token values - tokenpanel2, tokenpanel3,tokenpanel4.

<search>
       <query>|Field 1 Field2 Availability</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
           <finalized >
                      <condition match=" 'job.resultCount' != 0">
                              <set token="tokenpanel2">$result.Availability$</set>
                       </condition>
            </finalized >           
     </search>

Do the same for panel3, panel 4 and get tokenpanel3,tokenpanel4.

now in the panel1, you can do

|App1 Availability | App2 tokenpanel2 | App3 tokenpanel3 | App4 tokenpanel4|

Thanks

0 Karma

cmcdole
Path Finder

Thanks for responding. I see how to set the tokens in panel 2, 3, and 4. I don't understand how to call the tokens in Panel 1.

0 Karma

PowerPacked
Builder

You can call the tokens in the first panel search by

|App1 Availability | App2 $tokenpanel2$ | App3 $tokenpanel3$ | App4 $tokenpanel4$

forgot, missed the dollar signs around the token.

Thanks

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question and UpVote any others that helped.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...