Hello Experts,
I want to display a token value a Single value panel in the dashboard. Is there a way to pass on $token$ into the search query of the single value panel query? $token$ will be a number in my case.
Sonething like this?
<panel id="P_Five">
<single>
<search> <query>$token$</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
Thanks,
Naresh
Hi
Try like
<dashboard>
<label>single</label>
<row>
<panel>
<table>
<search>
<query>index="_internal" |stats count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<set token="count">$result.count$</set>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<single>
<search>
<query>|makeresults | eval count=$count$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</dashboard>
I was reading this as I'm looking something similar, that I haven't been able to figure it out.
So, I have different token values within a Dashboard and I want to add all these values into a single value component.
I thought it would be as simple as |makeresults |eval Total=$token1$+$token2$+$token1$ but it'snot working.
Any idea?
the single value component is showing "Search is waiting for input..." error
Hi
Try like
<dashboard>
<label>single</label>
<row>
<panel>
<table>
<search>
<query>index="_internal" |stats count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<set token="count">$result.count$</set>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<single>
<search>
<query>|makeresults | eval count=$count$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</dashboard>