Dashboards & Visualizations

How to edit my dashboard?

sravankaripe
Communicator

i have a Splunk dashboard with panel

alt text

i want to display it as
UserName : kathyk8

for example
alt text

0 Karma

cmerriman
Super Champion

You could eval a new token with that result and then put it into an HTML panel, however if you're generating a PDF, HTML tokens don't generate, so that won't work there. Another option is to create it as a single value, however the text is large, so if that isn't a big deal, then it's always an option.

...
</query>
<preview>
      <set token="token">$result.username$</set>
    </preview>
  </search>
........
<row>
    <panel>
      <html>
          $token$
          </html>
    </panel>
  </row>
0 Karma

woodcock
Esteemed Legend

Do not ask the same question twice. You can edit your question if you need to fix it.:
https://answers.splunk.com/answers/508194/help-me-with-splunk-dashboard-xml.html

woodcock
Esteemed Legend

You will need a custom visualization to remove the table header (modifying the value is trivial). Maybe you can make do with the existing "single value" visualization and it's options.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@sravankaripe - Can you provide your dashboard code and/or search (with any sensitive data anonymized)? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible.

0 Karma

sravankaripe
Communicator

User Details V2

<input type="time" token="field2" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-2h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="field3" searchWhenChanged="true">
  <label>UserName</label>
  <search>
    <query>--------------- | table UserName | where UserName!=""</query>
    <earliest>$field2.earliest$</earliest>
    <latest>$field2.latest$</latest>
  </search>
  <default></default>
  <!-- <choice value="DSC_*">DSC_*</choice>  -->
  <fieldForLabel>UserName</fieldForLabel>
  <fieldForValue>UserName</fieldForValue>
  <selectFirstChoice>true</selectFirstChoice>
</input>


<query>------------------- | table UserName | where UserName!=""</query>
      <earliest>$field2.earliest$</earliest>
      <latest>$field2.latest$</latest>
      <finalized>
        <set token="ThisIsMyToken">$result.UserName$</set>
      </finalized>
    </search>
    <option name="wrap">undefined</option>
    <option name="rowNumbers">undefined</option>
    <option name="drilldown">row</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>
0 Karma

niketn
Legend

@sravankaripe... based on your code sample it is a bit confusing as to what you are trying to do...

First you have multiselect input with the query to populate UserName (it implies your search returns multiple results). Then you have a table with same search where you are setting token through result.UserName. (this will always pick single value either from single result or first row of multiple results.

Can you please confirm whether your search will return single result or multiple? Can you provide a context of what you want from the two searches? and why exactly you need output like UserName : Kathy8?

Meanwhile your search should ideally run better if rearrange final two pieces like the following:

<your base search> search UserName!="" | table UserName
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...