Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How do you store search results in a token or ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi!
First, I recommend you learn how to use tokens in dashboards: Token usage in dashboards
You should add a done section to your inputlookup search to set the result as a token.
Then in your html block you can reference this token.
Kind of like this:
<dashboard>
<label>Test</label>
<row>
<panel>
<html>
<center>
<h1>Title: $mytoken$</h1>
</center>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=_* | head 1 | table sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<done>
<set token="mytoken">$result.sourcetype$</set>
</done>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi!
First, I recommend you learn how to use tokens in dashboards: Token usage in dashboards
You should add a done section to your inputlookup search to set the result as a token.
Then in your html block you can reference this token.
Kind of like this:
<dashboard>
<label>Test</label>
<row>
<panel>
<html>
<center>
<h1>Title: $mytoken$</h1>
</center>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=_* | head 1 | table sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<done>
<set token="mytoken">$result.sourcetype$</set>
</done>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is very useful. Thanks a lot. But I have another question in this case.
With this part:
<query>index=_* | head 1 | table sourcetype</query> <earliest>-60m@m</earliest> <latest>now</latest> <done> <set token="mytoken">$result.sourcetype$</set> </done> </search>
I can see on this place:
Title: $mytoken$
Only one entry, but my table has in this field many other values/results. How can I display all values of the hole fields?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So you have a table with one field/column and multiple rows, correct?
Tokens are used for single values/numbers, so this is going to get tricky.
You could do something like:
index=_* | stats list(sourcetype) as sourcetypes | eval sourcetypes=mvjoin(sourcetypes, ",")
This will put all values in a single string which can be saved in a token.
Alternatively, Splunk dashboards have a whole lot of JavaScript and CSS capabilities which might help you better.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey,
you can use outputlookup and use the result of this to show it in a dashboard.
Does this fit your need?
All the best,
Björn
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to display with a inputlookup search a field from the inputlookup in my dashboard between the html tags?
Is this possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
why do you only give half answers? or make it harder than it needs to be?
"you can use outputlookup and use the result of this to show it in a dashboard.
Does this fit your need? OK how ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
