Dashboards & Visualizations

Is there a way for a chart title to include data from a form field?


For a chart in a view, is it possible to have the chart's title include data the user has entered into the search form field?

Here's my effort:

  <label>Resource Usage</label>
  <fieldset autoRun="true">
    <input type="text" token="host">

         $host$ |
            p50(PercentProcessorTime_max) as "p50 CPU", 
            stdev(PercentProcessorTime_max) as "CPU stdev",
            count as DataPoints
            over ConcurrentTasks |
         eventstats sum(DataPoints) as Total_DataPoints  |
         eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
         fields "ConcurrentTasks" "Percent of Time"
      <title>Concurrent Task Rates on $host$, last 30 days</title>
      <option name="drilldown">row</option>
      <option name="showPager">true</option>
      <option name="count">15</option>
      <option name="displayRowNumbers">false</option>

The chart's data renders as expected. Unfortunately, the chart's title does not include the user input. Instead, it is literally $host$. Is the search field information even available outside the scope of the <searchString> tag? If so, how is it accessed?

Revered Legend

This is certainely possible with Advanced xml (using sideview util).

0 Karma

Splunk Employee
Splunk Employee

Version? It should work as advertised in 6.0.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...