Dashboards & Visualizations

Pass Variable to Panel Title.

Anantha123
Communicator

Hi All,

I have a requirement, where I need to show Query Result displayed to Panel Title.

index=foo
|timechart count as devAppCount
| eval devAppC=10*devAppCount
| table devAppC

Now I want to show the result of devAppC to Panel Title in UI.
Please help me.

Thanks
Anantha.

Tags (1)
0 Karma
1 Solution

gaurav_maniar
Builder

Hi @Anantha123 ,

Put this query inside a hidden panel/row. On search done action, set a token to the `devAppcz value and use that token as panel title.
Try the below code,

<row depends="$hidden$">
    <panel>
      <table>
        <search>
          <query>index=foo |timechart count as devAppCount | eval devAppC=10*devAppCount | head 1 | table devAppC</query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="panel_title">$result.devAppC$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>$panel_title$</title>
      <table>
        <search>
          <query>|makeresults | eval title="$panel_title$" | table title</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>

Accept the answer if it helps.

View solution in original post

Anantha123
Communicator

I tried this, but getting "$result.devAppC$" as a result but not value.

0 Karma

sandeepmakkena
Contributor

Does your query return only one result? If it returns more than one result do you take click input from the user?

0 Karma

Anantha123
Communicator

It gives one result , but varies depending on customer choosen.

0 Karma

arjunpkishore5
Motivator

What happenes when you have more than 1 value in the result? What should be in the title? The first value or the last?

0 Karma

gaurav_maniar
Builder

Hi @Anantha123 ,

Put this query inside a hidden panel/row. On search done action, set a token to the `devAppcz value and use that token as panel title.
Try the below code,

<row depends="$hidden$">
    <panel>
      <table>
        <search>
          <query>index=foo |timechart count as devAppCount | eval devAppC=10*devAppCount | head 1 | table devAppC</query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="panel_title">$result.devAppC$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>$panel_title$</title>
      <table>
        <search>
          <query>|makeresults | eval title="$panel_title$" | table title</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>

Accept the answer if it helps.

gaurav_maniar
Builder

Hi @Anantha123 ,

I have updated my answer.
please answer the comments from @sandeepmakkena and @arjunpkishore5 , so that we can provide better solution.

0 Karma

Anantha123
Communicator

Thanks Gaurav . This worked. Actly I aslo tried the same code to initiate the token but was trying to get the value from same Panel. This has to be obtained by different panel (hidden as you mentioned) . Thanks for the help. Wish we had a solution to get token value from same panel .

Thanks
Anantha.

0 Karma

gaurav_maniar
Builder

Hi,

It is also possible, without hidden panel
If your search is taking time to execute, so till your search execution is not completed, you will see the token variable as panel title.

<row>
     <panel>
       <title>$panel_title$</title>
       <table>
         <search>
           <query>index=foo |timechart count as devAppCount | eval devAppC=10*devAppCount | head 1 | table devAppC</query>
           <earliest>-1h@h</earliest>
           <latest>now</latest>
           <done>
             <set token="panel_title">$result.devAppC$</set>
           </done>
         </search>
       </table>
     </panel>
   </row>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...