Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- token value to be displayed as coloumns
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Can i pass token valiues to variables .
i have token values like swapmemoryfree , swapmemorycached ....
and these are field valiues in my index
i want to display these as coloumns
is it possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...
| table index source $fieldtoken$
Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...
| table index source $fieldtoken$
Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could have the different charts loaded and then just toggle on/off which ones are visible with a token.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Columns.. means.. do you want to display this a table, or table Header.
Try using html module in simple xml to create you desired view
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i mean these token values are my fields in my index
so if i am using a multiselect to select (swapmemoryfree OR swapmemorycached)
then passing them as a token value to my panel..
how can i display values of swapmemoryfree , swapmemorycached as table swapmemoryfree swapmemorycached
because these are my fileds in the index and these are passed as one token value
pls help
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
