Splunk Dev

help on under label token

jip31
Motivator

Hi

 

 

 <search>
<query>index=* EventCode=25753 
| stats count(EventCode) as toto 
| append 
    [| search index=* EventCode=* 
    | stats count(EventCode) as toto2]</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
            <done>
             <condition>
               <set token="NbHost">$result.toto$</set>
               <set token="NbHost2">$result.toto2$</set>
             </condition>
           </done>
        </search>
        <option name="drilldown">none</option>
        <option name="underLabel">$NbHost$ / $NbHost2$</option>

 

I dont succeed to display the NbHost2 value under my single panel

what is wrong please?

jip31_0-1721121339609.png

 

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The underlabel option does not perform evaluations.  Do the eval in a separate statement.

 <search>
<query>index=* EventCode=25753 
| stats count(EventCode) as toto 
| append 
    [| search index=* EventCode=* 
    | stats count(EventCode) as toto2]</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
            <done>
             <condition>
               <set token="NbHost">$result.toto$</set>
               <set token="NbHost2">$result.toto2$</set>
               <eval token="ratio">$NbHost$ / $NbHost2$</eval>
             </condition>
           </done>
        </search>
        <option name="drilldown">none</option>
        <option name="underLabel">$ratio$</option>
---
If this reply helps you, Karma would be appreciated.
0 Karma

jip31
Motivator

i have anything displayed under label...

is anybody can help?

Here is what i see

jip31_0-1721311408427.png

 

0 Karma
Get Updates on the Splunk Community!

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...