Dashboards & Visualizations

How to add the output of a search in the HTML panel ?

Real_captain
Path Finder

Hi 

Can someone please tell me how i can add the output of a search in the HTML Panel ? 

Example : In the below attached dashboard , i want to add the value of the field Schedule in the HTML Panel "Report : EOD

Real_captain_0-1722867078081.png

Output Required : In the HTML Panel , we need the value as 

Report : EOD                     T2S Synchronized Standard day (05/08/2024) in PPE

Current code : 

<row>
<panel>
<html>
<div style="text-align:center;font-style:bold;color:blue;font-size:150%">Report : <div style="display:inline-block;text-align:center;font-style:bold;color:red;font-size:100%">EOD</div>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| inputlookup T2S-PPE-Calendar.csv | eval today = strftime(now(), "%d/%m/%Y") | where DATE = today | eval Schedule = Schedule." (".today.") in PPE" | fields Schedule</query>
<earliest>1722776400.000</earliest>
<latest>1722865326.000</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>

 



 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden by using the depends attribute with a token that is never set

<panel depends="$neverset$">

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<row>
<panel>
<html>
<div style="text-align:center;font-style:bold;color:blue;font-size:150%">Report : <div style="display:inline-block;text-align:center;font-style:bold;color:red;font-size:100%">$schedule$</div>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| inputlookup T2S-PPE-Calendar.csv | eval today = strftime(now(), "%d/%m/%Y") | where DATE = today | eval Schedule = Schedule." (".today.") in PPE" | fields Schedule</query>
<earliest>1722776400.000</earliest>
<latest>1722865326.000</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="schedule">$result.Schedule$</set>
</done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
0 Karma

Real_captain
Path Finder

Thanks for the response @ITWhisperer . 

It helps to add the value of the schedule in the HTML header but it also shows the result in the panel. 
Can we hide/remove the panel with the value of the field Schedule. 

Current code : 

<row> <panel> <html> <div style="display:inline-block;text-align:right;font-style:bold;color:white;font-size:100%">$schedule$</div> </html> </panel> </row>

<row> <panel> <table> <search> <query>| inputlookup T2S-PPE-Calendar.csv | eval today = strftime(now(), "%d/%m/%Y") | where DATE = today | eval Schedule = Schedule." (".today.") in PPE" | fields Schedule</query> <earliest>1722776400.000</earliest> <latest>1722865326.000</latest>
<sampleRatio>1</sampleRatio>
<done> <set token="schedule">$result.Schedule$</set> </done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>


Real_captain_0-1722875586964.png

 

0 Karma

Real_captain
Path Finder

@ITWhisperer  : Can you please check my last query and help to provide a solution. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden by using the depends attribute with a token that is never set

<panel depends="$neverset$">
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Also you could consider putting the search in the init block so it isn't even in a panel

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...