Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- token value to be displayed as coloumns
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Can i pass token valiues to variables .
i have token values like swapmemoryfree , swapmemorycached ....
and these are field valiues in my index
i want to display these as coloumns
is it possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...
| table index source $fieldtoken$
Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...
| table index source $fieldtoken$
Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could have the different charts loaded and then just toggle on/off which ones are visible with a token.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Columns.. means.. do you want to display this a table, or table Header.
Try using html module in simple xml to create you desired view
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i mean these token values are my fields in my index
so if i am using a multiselect to select (swapmemoryfree OR swapmemorycached)
then passing them as a token value to my panel..
how can i display values of swapmemoryfree , swapmemorycached as table swapmemoryfree swapmemorycached
because these are my fileds in the index and these are passed as one token value
pls help
Fastest way to demo Observability
September Community Champions: A Shoutout to Our Contributors!
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
