Dashboards & Visualizations

token value to be displayed as coloumns

Mohsin123
Path Finder

Hi,

Can i pass token valiues to variables .
i have token values like swapmemoryfree , swapmemorycached ....
and these are field valiues in my index
i want to display these as coloumns
is it possible?

Tags (1)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...

 | table index source $fieldtoken$

Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Let's suppose that you have two fields you always want -- let's say index and source -- and then you want the user to be able to choose one additional field. Just have your dashboard code have a line like this at the end of the search...

 | table index source $fieldtoken$

Then whatever word gets selected in your dropdown will replace that token, and that field will be added to your table.

0 Karma

kmaron
Motivator

You could have the different charts loaded and then just toggle on/off which ones are visible with a token.

0 Karma

paramagurukarth
Builder

Columns.. means.. do you want to display this a table, or table Header.
Try using html module in simple xml to create you desired view

0 Karma

Mohsin123
Path Finder

i mean these token values are my fields in my index
so if i am using a multiselect to select (swapmemoryfree OR swapmemorycached)
then passing them as a token value to my panel..
how can i display values of swapmemoryfree , swapmemorycached as table swapmemoryfree swapmemorycached

because these are my fileds in the index and these are passed as one token value
pls help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...