how to add host value in Panel title or in the caption for single value visualization

[kranthimutyala]

Hi Guys,

I'm working on a dashboard where i need to show up the count of top 1 host in the single value visualization.
Below is the code i'm using

index=abc
|top limit=1 host
| table count

I need the host value to be displayed in the panel title or in the single value caption.

Thank you

[niketn · Accepted solution]

@kranthimutyala , try the following run anywhere example based on Splunk's _internal index which runs an independent search query to get the Top Host count and sets the two tokens one for host and other for count.

The count token is used in run anywhere search based on makeresults command. And title is displayed using host token. Please try out and confirm!

<dashboard>
  <label>Single Value with Panel Title</label>
  <!-- Independent search for Single Value Panel and Title of Top Host count -->
  <search>
    <query>index=_internal
| top 1 host  showperc=false
| table host count</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="$job.resultCount$==0">
        <set token="tokHost">Unavailable</set>
        <set token="tokCount">0</set>
      </condition>
      <condition>
        <set token="tokHost">$result.host$</set>
        <set token="tokCount">$result.count$</set>        
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <title>Host $tokHost$ value</title>
      <single>
        <search>
          <query>| makeresults
| fields - _time
| eval count="$tokCount$"
          </query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>