How to access a value of a table as a variable?

[splunk_vb]

I have a table that is only one column and one row so it just looks like this:

title

"value"

and I want to access this value in my dashboard without hardcoding it (because it will change depending on the user entry). How can I do this? I tried just using the title of the table and it just used the title of the table, not reading it as a variable. I was expecting it was something like title.value but I couldn't find an answer. I would appreciate any help!

[niketn]

@splunk_vb, are you looking for a table <drilldown> event handler to set token through $row.<fieldName>$ predefined token?

    <drilldown>
      <set token="tokTitle">$row.title$</set>
    </drilldown>

Please try out the following run anywhere example based on your question:

<dashboard>
  <label>Access Value of Token as Variable</label>
  <row>
    <panel>
      <title>tokTitle:$tokTitle$</title>
      <table>
        <search>
          <query>| makeresults
| fields - _time
| eval title="value"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="tokTitle">$row.title$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[skoelpin · Accepted solution]

You may have to create it as a hidden panel then $result.search$ to grab the result from that dashboard panel and pass it into another panel

[Abhi9835]

@skoelpin can u plz explain me more. this is not working for me.

[splunk_vb]

Hi @skoelpin thanks for your answer. It is a hidden panel, and I am using the output of this search as a value for a token. I tried < set token = " TokenName" > $result.search$ < / set > but it isn't working for me. How can I set the token to have the value of the cell?

[skoelpin]

Try this.. Once you add this, you will then go to the panel you want to pass the variable to and include this in the search $tokField1$. $result.search$ is what's going to fetch the result from one panel which will be passed to the other panel

<panel depends="$show_panel$">
      <title>Generate a timeframe</title>
      <table>
        <search>
          <query>| gentimes start=-1 
| addinfo 
| eval earliest=$field1.earliest$ 
| eval latest=$field1.latest$
| table earliest latest 
| format 
| eval search=trim(replace(search, "\(", ""))
| eval search=trim(replace(search, "\)", ""))</query>
          <done>
            <set token="tokField1">$result.search$</set>
          </done>
          <earliest>1528779600</earliest>
          <latest>1528866000</latest>
          <progress>
            <condition match="job.resultCount > 0">
                <set token="panel_show">true</set>
            </condition>
            <condition>
                <unset token="panel_show"/>
            </condition>
        </progress> 
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>

[splunk_vb]

This worked great! Thank you