Dashboards & Visualizations

How to add the output of a search in the HTML panel ?

Real_captain
Path Finder

Hi 

Can someone please tell me how i can add the output of a search in the HTML Panel ? 

Example : In the below attached dashboard , i want to add the value of the field Schedule in the HTML Panel "Report : EOD

Real_captain_0-1722867078081.png

Output Required : In the HTML Panel , we need the value as 

Report : EOD                     T2S Synchronized Standard day (05/08/2024) in PPE

Current code : 

<row>
<panel>
<html>
<div style="text-align:center;font-style:bold;color:blue;font-size:150%">Report : <div style="display:inline-block;text-align:center;font-style:bold;color:red;font-size:100%">EOD</div>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| inputlookup T2S-PPE-Calendar.csv | eval today = strftime(now(), "%d/%m/%Y") | where DATE = today | eval Schedule = Schedule." (".today.") in PPE" | fields Schedule</query>
<earliest>1722776400.000</earliest>
<latest>1722865326.000</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>

 



 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden by using the depends attribute with a token that is never set

<panel depends="$neverset$">

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<row>
<panel>
<html>
<div style="text-align:center;font-style:bold;color:blue;font-size:150%">Report : <div style="display:inline-block;text-align:center;font-style:bold;color:red;font-size:100%">$schedule$</div>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| inputlookup T2S-PPE-Calendar.csv | eval today = strftime(now(), "%d/%m/%Y") | where DATE = today | eval Schedule = Schedule." (".today.") in PPE" | fields Schedule</query>
<earliest>1722776400.000</earliest>
<latest>1722865326.000</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="schedule">$result.Schedule$</set>
</done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
0 Karma

Real_captain
Path Finder

Thanks for the response @ITWhisperer . 

It helps to add the value of the schedule in the HTML header but it also shows the result in the panel. 
Can we hide/remove the panel with the value of the field Schedule. 

Current code : 

<row> <panel> <html> <div style="display:inline-block;text-align:right;font-style:bold;color:white;font-size:100%">$schedule$</div> </html> </panel> </row>

<row> <panel> <table> <search> <query>| inputlookup T2S-PPE-Calendar.csv | eval today = strftime(now(), "%d/%m/%Y") | where DATE = today | eval Schedule = Schedule." (".today.") in PPE" | fields Schedule</query> <earliest>1722776400.000</earliest> <latest>1722865326.000</latest>
<sampleRatio>1</sampleRatio>
<done> <set token="schedule">$result.Schedule$</set> </done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>


Real_captain_0-1722875586964.png

 

0 Karma

Real_captain
Path Finder

@ITWhisperer  : Can you please check my last query and help to provide a solution. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden by using the depends attribute with a token that is never set

<panel depends="$neverset$">
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Also you could consider putting the search in the init block so it isn't even in a panel

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...