Dashboards & Visualizations

How to turn panel results into a variable?

splunk_enjoyer1
Explorer

Hello, I apologize if this is not in the correct location.

Basically, in order to simplify things, let's say I have a dashboard with 2 panels doing 2 seperate search queries.

Both are a "| stats count" and they both return values.

What I want to do is change the color of the value of Panel A based on the result of Panel B, and if for example the value of Panel B is 50% larger or smaller than Panel A, then the value of Panel A should turn yellow.

But I don't know how to turn the value of a panel into a variable or a token and use that variable or token to create a range based on a % of that value. Is this possible?

I did some research in splunk doccumentation and I thought I found a way to make it work but I don't know if it works because I'm not able to get it working.

Basically I tried doing <set token="result_token">$job.resultCount$</set> which in my mind would use the result count of the panel and convert that result into the "result_token" and then I would be able to use that "result_token" to do something like

<option name="drilldown">none</option>
<option name="rangeColors">["yellow","purple"]</option>
<option name="rangeValues"> "result_token" > 50% = yellow</option>
<option name="rangeValues"> "result_token" < 50% = yellow</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>

I don't know if I made any sense.

Labels (1)
Tags (1)
0 Karma
1 Solution

splunk_enjoyer1
Explorer

I managed to do this myself and forgot to close the post.

I was already doing the token part with the job.resultCount, but the issue I was having is that the XML code for the colour range of the single value panel wouldn't accept a variable as a number, it had to be a normal, so I wasn't able to use the token.

Basically I had to do the eval on panel A with the token and then giving the result as "severe" or "low", etc, to match the colour I wanted and use those hard-coded splunk colours and for that to work I had to delete the XML code that was tied to the single panel colouring.

Making panel A depended on the result token is not needed 🙂

Thank you for your input though 🙂

View solution in original post

0 Karma

jdunlea
Contributor

This does make sense. Have you tried to use a "depends" in one of your panels?

 

My recommendation would be as follows:

 

1. Set the token in panel B using something like <set token="$result_token$">$job.resultCount$</set>

 

2. Make panel A dependent on the result_token as follows

<panel depends="$result_token$>

 

3. Eval the result_token to a new field in the panel A search

| eval my_panel_b_token=$result_token$

 

4. Do whatever manipulation you need using the new field created in the previous step. 

 

5. Use any fields available from the results of the search in panel A within you panel A <option> parameters. 

 

Let me know if that does not make sense!

0 Karma

splunk_enjoyer1
Explorer

I managed to do this myself and forgot to close the post.

I was already doing the token part with the job.resultCount, but the issue I was having is that the XML code for the colour range of the single value panel wouldn't accept a variable as a number, it had to be a normal, so I wasn't able to use the token.

Basically I had to do the eval on panel A with the token and then giving the result as "severe" or "low", etc, to match the colour I wanted and use those hard-coded splunk colours and for that to work I had to delete the XML code that was tied to the single panel colouring.

Making panel A depended on the result token is not needed 🙂

Thank you for your input though 🙂

0 Karma

jdunlea
Contributor

No problem. Glad you got it resolved!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...