How to edit my dashboard?

sravankaripe · ‎03-07-2017

i have a Splunk dashboard with panel

i want to display it as
UserName : kathyk8

for example

cmerriman · ‎03-07-2017

You could eval a new token with that result and then put it into an HTML panel, however if you're generating a PDF, HTML tokens don't generate, so that won't work there. Another option is to create it as a single value, however the text is large, so if that isn't a big deal, then it's always an option.

...
</query>
<preview>
      <set token="token">$result.username$</set>
    </preview>
  </search>
........
<row>
    <panel>
      <html>
          $token$
          </html>
    </panel>
  </row>

woodcock · ‎03-07-2017

Do not ask the same question twice. You can edit your question if you need to fix it.:
https://answers.splunk.com/answers/508194/help-me-with-splunk-dashboard-xml.html

woodcock · ‎03-07-2017

You will need a custom visualization to remove the table header (modifying the value is trivial). Maybe you can make do with the existing "single value" visualization and it's options.

aaraneta_splunk · ‎03-07-2017

@sravankaripe - Can you provide your dashboard code and/or search (with any sensitive data anonymized)? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible.

sravankaripe · ‎03-07-2017

User Details V2

<input type="time" token="field2" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-2h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="field3" searchWhenChanged="true">
  <label>UserName</label>
  <search>
    <query>--------------- | table UserName | where UserName!=""</query>
    <earliest>$field2.earliest$</earliest>
    <latest>$field2.latest$</latest>
  </search>
  <default></default>
  <!-- <choice value="DSC_*">DSC_*</choice>  -->
  <fieldForLabel>UserName</fieldForLabel>
  <fieldForValue>UserName</fieldForValue>
  <selectFirstChoice>true</selectFirstChoice>
</input>


<query>------------------- | table UserName | where UserName!=""</query>
      <earliest>$field2.earliest$</earliest>
      <latest>$field2.latest$</latest>
      <finalized>
        <set token="ThisIsMyToken">$result.UserName$</set>
      </finalized>
    </search>
    <option name="wrap">undefined</option>
    <option name="rowNumbers">undefined</option>
    <option name="drilldown">row</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>

niketn · ‎03-07-2017

@sravankaripe... based on your code sample it is a bit confusing as to what you are trying to do...

First you have multiselect input with the query to populate UserName (it implies your search returns multiple results). Then you have a table with same search where you are setting token through result.UserName. (this will always pick single value either from single result or first row of multiple results.

Can you please confirm whether your search will return single result or multiple? Can you provide a context of what you want from the two searches? and why exactly you need output like UserName : Kathy8?

Meanwhile your search should ideally run better if rearrange final two pieces like the following:

<your base search> search UserName!="" | table UserName

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

How to edit my dashboard?

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?