Dashboards & Visualizations

Using SimpleXML, how do you populate singlevalue underLabel option with value from search?

jpass
Contributor

Is it possible to output other values from a search that populates a singlevalue element in my dashboard? What I want is to include a custom description under the singlevalue.

example:

 | EVAL singlevalue="5" | EVAL description="this is a description"  | TABLE singlevalue, description

 <option name="underLabel">$search.description$</option>

 Output:
 5
 this is a description
0 Karma
1 Solution

DMohn
Motivator

I assume this is what you intended:

<dashboard>
  <label>Result Token</label>
  <row>
    <panel>
      <title>Set underLabel by result</title>
      <single>
        <search>
          <query>| makeresults | eval label="MyLabel" | eval value="MyValue" | table value, label</query>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="testtoken">$result.label$</set>
          </done>
        </search>
        [...] other options [...]
        <option name="underLabel">$testtoken$</option>
      </single>
    </panel>
  </row>
</dashboard>

You have to set another token with the search results, as simpleXML seems to not be able to access the search results directly.

View solution in original post

DMohn
Motivator

I assume this is what you intended:

<dashboard>
  <label>Result Token</label>
  <row>
    <panel>
      <title>Set underLabel by result</title>
      <single>
        <search>
          <query>| makeresults | eval label="MyLabel" | eval value="MyValue" | table value, label</query>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="testtoken">$result.label$</set>
          </done>
        </search>
        [...] other options [...]
        <option name="underLabel">$testtoken$</option>
      </single>
    </panel>
  </row>
</dashboard>

You have to set another token with the search results, as simpleXML seems to not be able to access the search results directly.

jpass
Contributor

Easy enough. Thanks!

0 Karma

woodcock
Esteemed Legend

Not exactly, but this should be good enough for you unless you are really picky:

<dashboard>
  <label>Demonstration of a single value description</label>
  <description>description on single value panel</description>
  <row>
    <panel>
      <title>$description$</title>
      <single>
        <title>$description$</title>
        <search>
          <query>|makeresults | eval singlevalue="5" | eval  description="this is a description"  | table singlevalue description</query>
        <finalized>
          <set token="description">$result.description$</set>
        </finalized>
        </search>
      </single>
    </panel>
  </row>
</dashboard>
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...