Dashboards & Visualizations

Single value panel - Display token value

nareshinsvu
Builder

Hello Experts,

I want to display a token value a Single value panel in the dashboard. Is there a way to pass on $token$ into the search query of the single value panel query? $token$ will be a number in my case.

Sonething like this?

<panel id="P_Five">

  <single>
    <search>       <query>$token$</query>
      <earliest>@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>

Thanks,
Naresh

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try like

<dashboard>
  <label>single</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="count">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults | eval count=$count$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>

View solution in original post

pstamati
Path Finder

I was reading this as I'm looking something similar, that I haven't been able to figure it out.
So, I have different token values within a Dashboard and I want to add all these values into a single value component.

I thought it would be as simple as |makeresults |eval Total=$token1$+$token2$+$token1$ but it'snot working.

Any idea?

the single value component is showing "Search is waiting for input..." error

0 Karma

vnravikumar
Champion

Hi

Try like

<dashboard>
  <label>single</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="count">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults | eval count=$count$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...