Dashboards & Visualizations

how to add host value in Panel title or in the caption for single value visualization

kranthimutyala
Path Finder

Hi Guys,

I'm working on a dashboard where i need to show up the count of top 1 host in the single value visualization.
Below is the code i'm using

index=abc
|top limit=1 host
| table count

I need the host value to be displayed in the panel title or in the single value caption.

Thank you

0 Karma
1 Solution

niketn
Legend

@kranthimutyala , try the following run anywhere example based on Splunk's _internal index which runs an independent search query to get the Top Host count and sets the two tokens one for host and other for count.

The count token is used in run anywhere search based on makeresults command. And title is displayed using host token. Please try out and confirm!

<dashboard>
  <label>Single Value with Panel Title</label>
  <!-- Independent search for Single Value Panel and Title of Top Host count -->
  <search>
    <query>index=_internal
| top 1 host  showperc=false
| table host count</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="$job.resultCount$==0">
        <set token="tokHost">Unavailable</set>
        <set token="tokCount">0</set>
      </condition>
      <condition>
        <set token="tokHost">$result.host$</set>
        <set token="tokCount">$result.count$</set>        
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <title>Host $tokHost$ value</title>
      <single>
        <search>
          <query>| makeresults
| fields - _time
| eval count="$tokCount$"
          </query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@kranthimutyala , try the following run anywhere example based on Splunk's _internal index which runs an independent search query to get the Top Host count and sets the two tokens one for host and other for count.

The count token is used in run anywhere search based on makeresults command. And title is displayed using host token. Please try out and confirm!

<dashboard>
  <label>Single Value with Panel Title</label>
  <!-- Independent search for Single Value Panel and Title of Top Host count -->
  <search>
    <query>index=_internal
| top 1 host  showperc=false
| table host count</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="$job.resultCount$==0">
        <set token="tokHost">Unavailable</set>
        <set token="tokCount">0</set>
      </condition>
      <condition>
        <set token="tokHost">$result.host$</set>
        <set token="tokCount">$result.count$</set>        
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <title>Host $tokHost$ value</title>
      <single>
        <search>
          <query>| makeresults
| fields - _time
| eval count="$tokCount$"
          </query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...