Dashboards & Visualizations

Put search result into a token in INIT tag

fabrizioalleva
Path Finder

Hi all,
I'm new of a splunk. I'm wondering if there is a way or if it's possible to put a search result into a token in INIT tag section.
I've to calculate the total of the devices in order to pass it to a single to obtain somenthing like this

n
of total devices

<dashboard>
  <init>
       <set token="tot_device">some_search</set>
  </init>
  <label>Example</label>
    <row>
    <panel>
      <single>
        <title>Center</title>
        <search ref="rpt_random_color"></search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="showTrendIndicator">1</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x#33cc33","0x6db7c6","0xf7bc38","0xf58f39","#ff3300"]</option>
        <option name="rangeValues">[0,1,2,3,4]</option>
        <option name="underLabel">of $tot_device$</option>
        <option name="useColors">1</option>
        <option name="unit"></option>
     </single>
    </panel>
  </row>
</dashboard>

In tag set I try to put search or query tag I see that there no compilation error but no results are shown
Thanks in advance for replies

Fabrizio

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Please go through the following link to know more about init

https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/tokens#Set_tokens_on_page_load

You can try like

<form>
  <label>token</label>
  <search>
    <query>
       index="_internal" |stats count as total
    </query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <done>
      <condition>
        <set token="result">$result.total$</set>
      </condition>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <query>
        |makeresults |eval temp =$result$ |table temp
      </query>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

vishaltaneja070
Motivator

Hello @fabrizioalleva

Didn't get your point here, as you can directly run the search in single value visualisation. Why you need to use init?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...