Dashboards & Visualizations

Search with Pipe and Token Values only

simpkins1958
Contributor

I would like to populate a single value chart with calculation from tokens and nothing from a search. This works but would like to remove the index=nmi_main | head 1 which is not working.

        <search>
          <query>index=nmi_main | head 1 
               | eval totalMinutes=$totalSessionsToken$ * $minutesSavedValueToken$
               | table totalMinutes
          </query>
        </search>
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Use the | makeresults command as the generating command. That makes a single result event (with options for more) which has current _time and not a whole lot else.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Makeresults

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Use the | makeresults command as the generating command. That makes a single result event (with options for more) which has current _time and not a whole lot else.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Makeresults

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.