Dashboards & Visualizations

How to set single token with multiple values

gvnd
Path Finder

Hi,
My condition is::
I have following query in one panel;
Query 1::index="_internal" sourcetype=splunkd | table source | dedup source

result 1:: /opt/splunk/var/log/splunk/splunkd.log
/opt/splunk/var/log/splunk/metrics.log

Now I want to set a token for above result.

$result.source$>

Query2: index="_internal" sourcetype=splunkd source=$sourcefiles$ | table source | dedup source
result2: /opt/splunk/var/log/splunk/splunkd.log

My requirement is that I want both the results of first query in the same token value.

Thanks in advance.

Tags (1)
0 Karma

niketn
Legend

@gvnd can you please throw some light to your use case as well? Above example seems to be doing the same task in both the Searches. One that passes source value is also performing a dedup and once you supply the same to base query to second search again you are trying to perform dedup.

However, if you really want to use the values of a search within the base query of main search as far as it generates a field already present in the main search, you can try the following:

index="_internal" sourcetype=splunkd [search index="_internal" sourcetype=splunkd | table source | dedup source]
| table source 
| dedup source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI gvnd,
only one information: from first panel do you want to drilldown in another panel/form passing all the results?

In the second panel you could use the first search as a subsearch:

index="_internal" sourcetype=splunkd [ search index="_internal" sourcetype=splunkd | dedup source | table source  ] 
| dedup source
| table source 

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...