Dashboards & Visualizations

How to put query result in token?

praspai
Path Finder

Hi,

I want to out result from query into token. How can I do that.


<query>|inputlookup SourceType_Attributes | where Sourcetype=$source_type$ | table field1
<done>
<condition match=" '.resultCount' >= 1">
<set token="t_query_fields">$'result.field1'$</set>
</condition>
</done>

I am not sure I have a right syntax

0 Karma
1 Solution

vishaltaneja070
Motivator

Hello @praspai

Could you please try this:

<search>
    <query>
          index=main |eval x="Issue : Category="+category|eval x=if(u_subcategory>0,x+" Subcategory="+u_subcategory,x)|table x
        </query>
    <earliest>-24h</earliest>
    <latest>now</latest>
    <done>
      <set token="token_problem">$result.x$</set>
    </done>
  </search>

Please let me know if it works for you.

View solution in original post

vishaltaneja070
Motivator

Hello @praspai

Could you please try this:

<search>
    <query>
          index=main |eval x="Issue : Category="+category|eval x=if(u_subcategory>0,x+" Subcategory="+u_subcategory,x)|table x
        </query>
    <earliest>-24h</earliest>
    <latest>now</latest>
    <done>
      <set token="token_problem">$result.x$</set>
    </done>
  </search>

Please let me know if it works for you.

493669
Super Champion

you can try like below:

<condition match=" $job.resultCount$ >= 1">
    <set token="t_query_fields">$result.field1$</set>
</condition>

refer this: http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/tokens

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...