Dashboards & Visualizations

token value to be displayed as coloumns

Mohsin123
Path Finder

Hi,

Can i pass token valiues to variables .
i have token values like swapmemoryfree , swapmemorycached ....
and these are field valiues in my index
i want to display these as coloumns
is it possible?

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...

 | table index source $fieldtoken$

Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.

View solution in original post

0 Karma

DalJeanis
Legend

Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...

 | table index source $fieldtoken$

Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.

0 Karma

kmaron
Motivator

You could have the different charts loaded and then just toggle on/off which ones are visible with a token.

0 Karma

paramagurukarth
Builder

Columns.. means.. do you want to display this a table, or table Header.
Try using html module in simple xml to create you desired view

0 Karma

Mohsin123
Path Finder

i mean these token values are my fields in my index
so if i am using a multiselect to select (swapmemoryfree OR swapmemorycached)
then passing them as a token value to my panel..
how can i display values of swapmemoryfree , swapmemorycached as table swapmemoryfree swapmemorycached

because these are my fileds in the index and these are passed as one token value
pls help

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...