Dashboards & Visualizations

Passing Text to a SingleValue Panel

zschmid
Path Finder

Is it possible to pass text to a SingleValue Panel? I am able to create a SingleValue panel and display numeric values with no problem. But as soon as I take a field that returns a text value instead of numeric the SingleValue field displays "Invalid Field".

Am I taking the right approach to displaying a single text value?

 <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
      <param name="search">index=dna sourcetype=dna dest_host="XXXXXXXX" | dedup dest_host | </param>
      <param name="earliest">-24h</param>
      <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1">
      <param name="search">stats first(dest_ip)</param>
         <module name="SingleValue">
           <param name="field">first(dest_ip)</param>
           <param name="beforeLabel">IP Address:</param>
         </module>
    </module>
    <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp2">
      <param name="search">stats first(dest_city) AS city first(dest_state) AS state first(dest_country) AS country | eval location=city.",".state." ".country</param>
         <module name="SingleValue">
           <param name="field">location</param>
           <param name="beforeLabel">Home Location:</param>
         </module>
    </module>
</module>
Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

This is a common problem that you're hitting but it's not a SingleValue problem. SingleValue can display text values just fine.

What it is, is that when you refer to a field in a postProcess search, you have to make sure that the field will be there in the underlying search results.

So here the postProcess is referring to a field called 'dest_ip', however nobody told the main search that 'dest_ip' was an important field so it will not have preserved it. (Splunkd doesnt do unnecessary work- it'll only extract and preserve the fields that it beleives are necessary to fulfill the search at search time)

Short version: If you add | fields dest_host dest_ip onto the end of your base search it'll work.

Check out the 'Using postProcess on dashboards' view within the 'UI Examples for 4.1' app, available on splunkbase. It talks a lot about the pitfalls that can ruin your day when you're using postprocess and this is definitely one.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

This is a common problem that you're hitting but it's not a SingleValue problem. SingleValue can display text values just fine.

What it is, is that when you refer to a field in a postProcess search, you have to make sure that the field will be there in the underlying search results.

So here the postProcess is referring to a field called 'dest_ip', however nobody told the main search that 'dest_ip' was an important field so it will not have preserved it. (Splunkd doesnt do unnecessary work- it'll only extract and preserve the fields that it beleives are necessary to fulfill the search at search time)

Short version: If you add | fields dest_host dest_ip onto the end of your base search it'll work.

Check out the 'Using postProcess on dashboards' view within the 'UI Examples for 4.1' app, available on splunkbase. It talks a lot about the pitfalls that can ruin your day when you're using postprocess and this is definitely one.

0 Karma

zschmid
Path Finder

Awesome. This worked perfectly. Thanks for the quick response!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...