How to turn panel results into a variable?

[splunk_enjoyer1]

Hello, I apologize if this is not in the correct location.

Basically, in order to simplify things, let's say I have a dashboard with 2 panels doing 2 seperate search queries.

Both are a "| stats count" and they both return values.

What I want to do is change the color of the value of Panel A based on the result of Panel B, and if for example the value of Panel B is 50% larger or smaller than Panel A, then the value of Panel A should turn yellow.

But I don't know how to turn the value of a panel into a variable or a token and use that variable or token to create a range based on a % of that value. Is this possible?

I did some research in splunk doccumentation and I thought I found a way to make it work but I don't know if it works because I'm not able to get it working.

Basically I tried doing <set token="result_token">$job.resultCount$</set> which in my mind would use the result count of the panel and convert that result into the "result_token" and then I would be able to use that "result_token" to do something like

<option name="drilldown">none</option>
<option name="rangeColors">["yellow","purple"]</option>
<option name="rangeValues"> "result_token" > 50% = yellow</option>
<option name="rangeValues"> "result_token" < 50% = yellow</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>

I don't know if I made any sense.

[jdunlea]

This does make sense. Have you tried to use a "depends" in one of your panels?

My recommendation would be as follows:

1. Set the token in panel B using something like <set token="$result_token$">$job.resultCount$</set>

2. Make panel A dependent on the result_token as follows

<panel depends="$result_token$>

3. Eval the result_token to a new field in the panel A search

| eval my_panel_b_token=$result_token$

4. Do whatever manipulation you need using the new field created in the previous step. 

5. Use any fields available from the results of the search in panel A within you panel A <option> parameters. 

Let me know if that does not make sense!

[splunk_enjoyer1 · Accepted solution]

I managed to do this myself and forgot to close the post.

I was already doing the token part with the job.resultCount, but the issue I was having is that the XML code for the colour range of the single value panel wouldn't accept a variable as a number, it had to be a normal, so I wasn't able to use the token.

Basically I had to do the eval on panel A with the token and then giving the result as "severe" or "low", etc, to match the colour I wanted and use those hard-coded splunk colours and for that to work I had to delete the XML code that was tied to the single panel colouring.

Making panel A depended on the result token is not needed 🙂

Thank you for your input though 🙂

[jdunlea]

No problem. Glad you got it resolved!