Dashboards & Visualizations

How do I show results from a panel in another panel?

cmcdole
Path Finder

Here is the layout I'm going for. I need the Availability results from panels 2, 3 and 4 to populate panel 1
|Panel 1
|App1 Availability | App2 Availability | App3 Availability | App4 Availability|
|100% 100% 100% 100% |


|Panel 2 - App2
|Field 1 Field2 Availability
|blah   blah  100%


|Panel 3 - App3
|Field 1 Field2 Availability
|blah   blah  100%


|Panel 4 - App4
|Field 1 Field2 Availability
|blah   blah  100%

Tags (1)
0 Karma
1 Solution

niketn
Legend

@cmcdole, please try the following run anywhere dashboard. <panel2>,<panel3> and <panel4> search queries would need to be replaced with what you currently have in your dashboard (current query with |makeresults in panel 2, 3 and 4 are used to create dummy data as per your question). Each of the three panels will set tokens tokAvailabilityApp2,tokAvailabilityApp3 and tokAvailabilityApp4 respectively.

<panel1> code would need to remain as it is i.e. do not replace the | maekresults command as it creates a search where three App's status is set from their respective tokens.

alt text

Following is the complete Simple XML code for run anywhere dashboard example above. Please try out and confirm:

<dashboard>
  <label>Panel from results of other panels</label>
  <row>
    <panel>
      <title>Panel 1 - All Apps Status</title>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval "App1 Availability"="$tokAvailabilityApp1$","App2 Availability"="$tokAvailabilityApp2$","App3 Availability"="$tokAvailabilityApp3$"
          </query>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Panel 2 - App1</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp1">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App2</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp2">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App3</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp3">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

cmcdole
Path Finder

This worked perfectly. I only had to incorporate my original queries. Thank you so much!!

0 Karma

niketn
Legend

@cmcdole, please try the following run anywhere dashboard. <panel2>,<panel3> and <panel4> search queries would need to be replaced with what you currently have in your dashboard (current query with |makeresults in panel 2, 3 and 4 are used to create dummy data as per your question). Each of the three panels will set tokens tokAvailabilityApp2,tokAvailabilityApp3 and tokAvailabilityApp4 respectively.

<panel1> code would need to remain as it is i.e. do not replace the | maekresults command as it creates a search where three App's status is set from their respective tokens.

alt text

Following is the complete Simple XML code for run anywhere dashboard example above. Please try out and confirm:

<dashboard>
  <label>Panel from results of other panels</label>
  <row>
    <panel>
      <title>Panel 1 - All Apps Status</title>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval "App1 Availability"="$tokAvailabilityApp1$","App2 Availability"="$tokAvailabilityApp2$","App3 Availability"="$tokAvailabilityApp3$"
          </query>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Panel 2 - App1</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp1">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App2</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp2">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Panel 3 - App3</title>
      <table>
        <search>
          <query>| makeresults
| eval Field1="blah",Field2="blah",Availability="100%"
| table Field1, Field2, Availability</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokAvailabilityApp3">$result.Availability$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jrfrost
Explorer

What's the underling search(s) for each panel, is not possible to use the same search and just display the availability field in the first panel

0 Karma

PowerPacked
Builder

Hi @ cmcdole

Use this search in panel2, panel3 & panel4 to get the token values - tokenpanel2, tokenpanel3,tokenpanel4.

<search>
       <query>|Field 1 Field2 Availability</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
           <finalized >
                      <condition match=" 'job.resultCount' != 0">
                              <set token="tokenpanel2">$result.Availability$</set>
                       </condition>
            </finalized >           
     </search>

Do the same for panel3, panel 4 and get tokenpanel3,tokenpanel4.

now in the panel1, you can do

|App1 Availability | App2 tokenpanel2 | App3 tokenpanel3 | App4 tokenpanel4|

Thanks

0 Karma

cmcdole
Path Finder

Thanks for responding. I see how to set the tokens in panel 2, 3, and 4. I don't understand how to call the tokens in Panel 1.

0 Karma

PowerPacked
Builder

You can call the tokens in the first panel search by

|App1 Availability | App2 $tokenpanel2$ | App3 $tokenpanel3$ | App4 $tokenpanel4$

forgot, missed the dollar signs around the token.

Thanks

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question and UpVote any others that helped.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...