Dashboards & Visualizations

How to set single token with multiple values

gvnd
Path Finder

Hi,
My condition is::
I have following query in one panel;
Query 1::index="_internal" sourcetype=splunkd | table source | dedup source

result 1:: /opt/splunk/var/log/splunk/splunkd.log
/opt/splunk/var/log/splunk/metrics.log

Now I want to set a token for above result.

$result.source$>

Query2: index="_internal" sourcetype=splunkd source=$sourcefiles$ | table source | dedup source
result2: /opt/splunk/var/log/splunk/splunkd.log

My requirement is that I want both the results of first query in the same token value.

Thanks in advance.

Tags (1)
0 Karma

niketn
Legend

@gvnd can you please throw some light to your use case as well? Above example seems to be doing the same task in both the Searches. One that passes source value is also performing a dedup and once you supply the same to base query to second search again you are trying to perform dedup.

However, if you really want to use the values of a search within the base query of main search as far as it generates a field already present in the main search, you can try the following:

index="_internal" sourcetype=splunkd [search index="_internal" sourcetype=splunkd | table source | dedup source]
| table source 
| dedup source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI gvnd,
only one information: from first panel do you want to drilldown in another panel/form passing all the results?

In the second panel you could use the first search as a subsearch:

index="_internal" sourcetype=splunkd [ search index="_internal" sourcetype=splunkd | dedup source | table source  ] 
| dedup source
| table source 

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...