Dashboards & Visualizations

How to pass field values into splunk dashboard panels ?

puneetkharband1
Path Finder

I have splunk dashboard where I am displaying logs from 2 different data centers and based on data centers number of host/hostname changes.

if I select datacenter 1 from drop down then server 1 & 2 becomes active and their logs reflect in panels below.
if I select datacenter 2 from drop down then server 3 & 4 becomes active and their logs reflect in panels below.

I dont want to create 2 seapate dashboards as this DC numbers will increase so wanted to have one single dashboard.

Server is a field which has 4 values server1-4

Please recommend solutions how do I pass values from server field to another panels in the same dashboard.

0 Karma

niketn
Legend

@puneetkharbanda you need to add more details as to what kind of SPLs are used in Panel 1, 2, 3, 4.

Use Case 1: If you want to just change the values server1, server2, server3 and server4 in the underlying SPLs you can just code the same in the <change> event handler of the datacenter dropdown.

Use Case 2: If the SPLs for server1 and 2 differ completely from server 3 and 4, you can
Case a: Set the SPL as token for underlying panels.
Case b: Set and unset token based on whether datacenter 1 or datacenter 2 is chosen and have depends and rejects for the token applied on respective panels and their searches so that they get hidden and do not run depending on which datacenter is chosen.

Please elaborate your use case of passing value and consuming in the respective panels so that community can assist you better.

Meanwhile for Use Case 1 you can try the following in the Datacenter dropdown

    <change>
         <condition value="datacenter1">
               <set token="tokServer">server1,server2</set>
         </condition>
         <condition value="datacenter2">
               <set token="tokServer">server3,server4</set>
         </condition>
    </change>

    then use token tokServer in the respective panels like

             server IN ($tokServer$)

PS: This is just one example, there are several ways to implement this depending on your use case as described above and also underlying SPLs.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

puneetkharband1
Path Finder

@somesoni2 can you please recommend any solution to this ?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...