Dashboards & Visualizations

How to create chart to not display single value data when * is set in a token?

stobipole
New Member

Hi,

I'm relatively new to Splunk so it's been a bit of a learning curve!

I'm building a dashboard using Splunk Cloud Dashboard Studio that shows both overview and site specific visualisations - key items being a map to show where all sites are, and once a site is selected some specific data.

Basics of Dashboard:

Site Name Dropdown (sets token $SiteName$):
All (*)

Site 1

Site 2

Map - configured with markers (lat/long)

Single Value - configured to display the site name that was selected from dropdown ($SiteName$ token)

Basic Search - <base search> | search "Site Name" = "$SiteName$"

 

Behaviour:

Map and Single Value visualisations work as desired when a specific site is selected.

<base search> | search "Site Name" = "Site 2"

 

Issue:

When All is selected (sets token $SiteName$ to *) the search becomes:

<base search> | search "Site Name" ="*"

Map - shows all sites (desired)

Single Value - shows 'Site 1' as it's the first returned value of the search (all sites are returned in the search results)

 

Any Suggestions?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is it that you want the single item to display when * is selected?

What is your search for the single item?

0 Karma

stobipole
New Member

Hi,

Either nothing or 'Please select a site'

| inputlookup siteDetails.csv

| search "Site Name" ="$SiteName$"

 

Single value box uses the "Site Name" value

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| inputlookup siteDetails.csv

| where 'Site Name' ="$SiteName$"
0 Karma

stobipole
New Member

Thank you, I think that has done it - should have asked earlier, been trying to understand this for a couple of days!

I'll mark as accepted solution once I've done some further validation

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...