Splunk Search

How to dynamically set a variable for Dashboard Panel Title?

GaryZ
Path Finder

I am looking to dynamically update the Splunk Dashboard panel title, depending on options I've chosen from a dropdown menu in Splunk Dashboard.

I've tried the following

  <row>
    <panel>
      <title>Panel1: (Hardware: $hardware1$ - $unit_used$</title>
        ...
        <search base="main_search">
          <query>
          ...

          | eval _unit_used = "ms"
  
          </query>
          <done>
            <set token="unit_used">$result._unit_used$</set>  
          </done>
        </search>

 

 

However when the script runs, I am seeing

"Hardware: abc - $result.unit_used$".

instead of seeing

"Hardware: abc - ms"

 

Is there a way of achieving this?

Thanks

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I suspect the title is set before any searches run so there are no results from which to pull a field value.

OTOH, if the value for the title comes from a drop-down then you should use a form token instead of a results token.

$form._unit_used$
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...