Dashboards & Visualizations

Single value panel - Display token value

nareshinsvu
Builder

Hello Experts,

I want to display a token value a Single value panel in the dashboard. Is there a way to pass on $token$ into the search query of the single value panel query? $token$ will be a number in my case.

Sonething like this?

<panel id="P_Five">

  <single>
    <search>       <query>$token$</query>
      <earliest>@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>

Thanks,
Naresh

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try like

<dashboard>
  <label>single</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="count">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults | eval count=$count$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>

View solution in original post

pstamati
Path Finder

I was reading this as I'm looking something similar, that I haven't been able to figure it out.
So, I have different token values within a Dashboard and I want to add all these values into a single value component.

I thought it would be as simple as |makeresults |eval Total=$token1$+$token2$+$token1$ but it'snot working.

Any idea?

the single value component is showing "Search is waiting for input..." error

0 Karma

vnravikumar
Champion

Hi

Try like

<dashboard>
  <label>single</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="count">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults | eval count=$count$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...