Is it possible to reuse dashboard panel output across other panels?

[POR160893]

Hi,

I have a dashboard with a number of panels. However, some panels use the final answers from other panels as inputs for their panel's calculations. I find myself reusing a lot of the existing queries across a number of panels as a result. Is there a more inheritable way to pass output (be it a number) from one panel and make it accessible on another panel? Would tokens be an option or a global variable?



Thanks,
Patrick

[POR160893]

Here is my current XML code:
Panel 1, I am setting the query's result to token called "total_tok":
<panel>
<title>Score</title>
<single>
<search base="base">
<query>where ((EDR=1 OR EDR="Exception Approved" OR EDR="Exception Submitted") AND (NGAV=1 OR NGAV="Exception Approved" OR NGAV="Exception Submitted")) |stats count as Compliant
| appendcols [|loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent SRO" events=false |eval edr_compliant=if(EDR=1, "Yes", "No"), ngav_compliant=if(NGAV=1, "Yes", "No") , mcafee_active45d = if(mcafee_active45d=1,"Active","Not Active")
| fields - dell_discovery_mac dell_discovery_ip
| search dell_discovery_host="*" EDR="*" NGAV="*" DeviceOwnerL5Name="*" DeviceOwnerL4Name="*" | search
|stats count as Total
| eval Total = Total]
| eval percent=round((Compliant/Total)*100,2)."%"
| table percent</query>
<done>
<set token="total_tok">$result.percent$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>

Next, on Panel 2, I am simply calling this same token and multiplying i (the calculation is a lot longer in my actual application btw 🙂 ) 
<panel>
<title>EDR Compliant - Percentage</title>
<single>
<search>
<query>$total_tok$*2</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>

Am I calling the token from Panel 1 incorrectly as Panel 2 just says the following:

Many thanks,
Patrick

[bowesmana]

Certainly you can. That's all about base searches and post processing searches

Here's an example dashboard where there is a search defined outside any panel, then two panels, each uses the output from that base search to calculate some new value from the results of the base search.

<dashboard>
  <label>tmp</label>
  <search id="base">
    <query>| tstats count where index=* by index sourcetype</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <title>Indexes</title>
      <single>
        <search base="base">
          <query>| stats dc(index) as indexes</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <title>Sourcetypes</title>
      <single>
        <search base="base">
          <query>| stats dc(sourcetype) as sourcetype</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>

 See this page on searches

https://docs.splunk.com/Documentation/Splunk/8.2.6/Viz/Savedsearches

Note that a base search should always use a transforming command and not just be a list of events. If you do not use a transforming command, then you must always finish the search with a fields statement to control which fields are available to the post processing searches.

Also, any search in any panel can be a base search, just give the search an id and another search can then reference that search with base="..."

[POR160893]

This would be good but I’m not aloud to change the base search in this dashboard. Most of the panels just perform counts under different filtering. What I need to access these individual answers in 2 panels. Could I not assign each individual panel output to a token in a <done> event handler and just access the tokens in the new panel I need?

[bowesmana]

And this <row> element shows you how using makeresults and tokens inside a single panel

  <row>
    <panel>
      <title>Indexes Using makeresults with token</title>
      <single>
        <search>
          <query>
            | makeresults
            | eval value=$indexes$
          </query>
        </search>
      </single>
    </panel>
    <panel>
      <title>Sourcetypes Using makeresults with token</title>
      <single>
        <search>
          <query>
            | makeresults
            | eval value=$sourcetypes$
          </query>
        </search>
      </single>
    </panel>
  </row>

[bowesmana]

Yes, you can also use tokens set in <done> handlers, which you can use in other panels.

This is a simple way of creating your own <html> panels with single values you want from other searches.

This is another example, with a hidden search generating the tokens you want, which are then used in the other two html panels.

<dashboard>
  <label>tmp</label>
  <row>
    <panel depends="$hidden$">
      <table>
        <search id="base">
          <query>| tstats count where index=* by index sourcetype
          | stats dc(index) as index dc(sourcetype) as sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="indexes">$result.index$</set>
            <set token="sourcetypes">$result.sourcetype$</set>
          </done>
        </search>
      </table>
    </panel>
    <panel>
      <html>
        <h1>$indexes$ Indexes</h1>
      </html>
    </panel>
    <panel>
      <html>
        <h1>$sourcetypes$ Sourcetypes</h1>
      </html>
    </panel>
  </row>
</dashboard>

[POR160893]

Here is my current XML code:
Panel 1, I am setting the query's result to token called "total_tok":
<panel>
<title>Score</title>
<single>
<search base="base">
<query>where ((EDR=1 OR EDR="Exception Approved" OR EDR="Exception Submitted") AND (NGAV=1 OR NGAV="Exception Approved" OR NGAV="Exception Submitted")) |stats count as Compliant
| appendcols [|loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent SRO" events=false |eval edr_compliant=if(EDR=1, "Yes", "No"), ngav_compliant=if(NGAV=1, "Yes", "No") , mcafee_active45d = if(mcafee_active45d=1,"Active","Not Active")
| fields - dell_discovery_mac dell_discovery_ip
| search dell_discovery_host="*" EDR="*" NGAV="*" DeviceOwnerL5Name="*" DeviceOwnerL4Name="*" | search
|stats count as Total
| eval Total = Total]
| eval percent=round((Compliant/Total)*100,2)."%"
| table percent</query>
<done>
<set token="total_tok">$result.percent$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>

Next, on Panel 2, I am simply calling this same token and multiplying i (the calculation is a lot longer in my actual application btw 🙂 ) 
<panel>
<title>EDR Compliant - Percentage</title>
<single>
<search>
<query>$total_tok$*2</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>

Am I calling the token from Panel 1 incorrectly as Panel 2 just says the following:

Thanks,
Patrick

[POR160893]

Perfect, this solved my problem. Thanks and I gave you karma