Splunk Search

How do I get data from a stats table to send as a token?

jadengoho
Builder

Hi ,
I have a table with a single data value inside.

  |makeresults 
   |eval value=1

I just want to get the value "1" and send as a token after the table completely finish.

Currently, i can get the data but only when i click the field.

Thanks in advance

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@jadengoho ,
You can add a event based token on the completion of search of table by using done.
E.g.

<dashboard>
  <label>Auto Load Of Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval value=1</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
          <done>
            <set token="value_token">$result.value$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval mytoken=$value_token$</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@jadengoho ,
You can add a event based token on the completion of search of table by using done.
E.g.

<dashboard>
  <label>Auto Load Of Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval value=1</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
          <done>
            <set token="value_token">$result.value$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval mytoken=$value_token$</query>
          <earliest>-1s@s</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

overratedkungmi
New Member
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...