Solved: How to pass values between panels to make calculat...

majeedk_nbg · ‎01-19-2023

I have 6 panels on my dashboard and each one of then shows number of customers going through each phase of journey. Take this made up example:

Panel 1: Panel 2: Panel 3: Panel 4: Panel5:

400 250 330 120 80

Is it possible add panel 6, which automatically shows the difference of values from Panel 1 and Panel 2

The queries behind are very complex so I don't re run the same two queries inside Panel 6 to get this value.

ITWhisperer · ‎01-19-2023

  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="tablevalue1">$result.value$</set>
          </done>
          <query>| makeresults
| eval value="ABC"
| table value</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <done>
            <set token="tablevalue2">$result.value$</set>
          </done>
          <query>| makeresults
| eval value="DEF"
| table value</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
Value from first table = $tablevalue1$<br/>
Value from second table = $tablevalue2$
      </html>
    </panel>
  </row>

View solution in original post

majeedk_nbg · ‎01-19-2023

@ITWhisperer can you please provide an example?

ITWhisperer · ‎01-19-2023

  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="tablevalue1">$result.value$</set>
          </done>
          <query>| makeresults
| eval value="ABC"
| table value</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <done>
            <set token="tablevalue2">$result.value$</set>
          </done>
          <query>| makeresults
| eval value="DEF"
| table value</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
Value from first table = $tablevalue1$<br/>
Value from second table = $tablevalue2$
      </html>
    </panel>
  </row>

ITWhisperer · ‎01-19-2023

Assuming you are using SimpleXML dashboards, you could try adding a <done></done> block to your dashboard panel searches and store a value from the result into a token, then display those token values in panel 6

How to pass values between panels to make calculations?

dashboard

panel

Tech Talk Recap | Mastering Threat Hunting

Observability for AI Applications: Troubleshooting Latency

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Are you a member of the Splunk Community?