Dashboards & Visualizations

How to set single token with multiple values

gvnd
Path Finder

Hi,
My condition is::
I have following query in one panel;
Query 1::index="_internal" sourcetype=splunkd | table source | dedup source

result 1:: /opt/splunk/var/log/splunk/splunkd.log
/opt/splunk/var/log/splunk/metrics.log

Now I want to set a token for above result.

$result.source$>

Query2: index="_internal" sourcetype=splunkd source=$sourcefiles$ | table source | dedup source
result2: /opt/splunk/var/log/splunk/splunkd.log

My requirement is that I want both the results of first query in the same token value.

Thanks in advance.

Tags (1)
0 Karma

niketn
Legend

@gvnd can you please throw some light to your use case as well? Above example seems to be doing the same task in both the Searches. One that passes source value is also performing a dedup and once you supply the same to base query to second search again you are trying to perform dedup.

However, if you really want to use the values of a search within the base query of main search as far as it generates a field already present in the main search, you can try the following:

index="_internal" sourcetype=splunkd [search index="_internal" sourcetype=splunkd | table source | dedup source]
| table source 
| dedup source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI gvnd,
only one information: from first panel do you want to drilldown in another panel/form passing all the results?

In the second panel you could use the first search as a subsearch:

index="_internal" sourcetype=splunkd [ search index="_internal" sourcetype=splunkd | dedup source | table source  ] 
| dedup source
| table source 

Bye.
Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...