Dashboards & Visualizations

Using SimpleXML, how do you populate singlevalue underLabel option with value from search?

jpass
Contributor

Is it possible to output other values from a search that populates a singlevalue element in my dashboard? What I want is to include a custom description under the singlevalue.

example:

 | EVAL singlevalue="5" | EVAL description="this is a description"  | TABLE singlevalue, description

 <option name="underLabel">$search.description$</option>

 Output:
 5
 this is a description
0 Karma
1 Solution

DMohn
Motivator

I assume this is what you intended:

<dashboard>
  <label>Result Token</label>
  <row>
    <panel>
      <title>Set underLabel by result</title>
      <single>
        <search>
          <query>| makeresults | eval label="MyLabel" | eval value="MyValue" | table value, label</query>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="testtoken">$result.label$</set>
          </done>
        </search>
        [...] other options [...]
        <option name="underLabel">$testtoken$</option>
      </single>
    </panel>
  </row>
</dashboard>

You have to set another token with the search results, as simpleXML seems to not be able to access the search results directly.

View solution in original post

DMohn
Motivator

I assume this is what you intended:

<dashboard>
  <label>Result Token</label>
  <row>
    <panel>
      <title>Set underLabel by result</title>
      <single>
        <search>
          <query>| makeresults | eval label="MyLabel" | eval value="MyValue" | table value, label</query>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="testtoken">$result.label$</set>
          </done>
        </search>
        [...] other options [...]
        <option name="underLabel">$testtoken$</option>
      </single>
    </panel>
  </row>
</dashboard>

You have to set another token with the search results, as simpleXML seems to not be able to access the search results directly.

jpass
Contributor

Easy enough. Thanks!

0 Karma

woodcock
Esteemed Legend

Not exactly, but this should be good enough for you unless you are really picky:

<dashboard>
  <label>Demonstration of a single value description</label>
  <description>description on single value panel</description>
  <row>
    <panel>
      <title>$description$</title>
      <single>
        <title>$description$</title>
        <search>
          <query>|makeresults | eval singlevalue="5" | eval  description="this is a description"  | table singlevalue description</query>
        <finalized>
          <set token="description">$result.description$</set>
        </finalized>
        </search>
      </single>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...