Splunk Search

How to pass search result from one Panel to a different Panel?

_dave_b
Communicator

Hello. I'm trying to construct a footer containing my app's version in a dashboard. The footer resides in a different panel. I can find the version from a search, but I haven't found a way to pass that value into the lower panel. It seems like this can be done by using tokens, but my research hasn't revealed a way to do this specifically.

Conceptually, I want the dashboard code to work like this:

Panel1:
<query>| rest /servicesNS/nobody/system/apps/local/ | search title="MyApp" | table title version</query>

Panel2:
< html >< center >< h8 >< img src="/static/app/MyApp/appLogo.png" / > MyApp version $version$< /h8 >< /center >< /html >

Any helpful pointers or references would be greatly appreciated!

Thanks

0 Karma

somesoni2
Revered Legend

Give this a try (run anywhere sample for Splunk 6.3.x)

<dashboard>
  <label>Token from Search</label> 
  <row>
    <panel>
      <table>
         <search>
          <query>| gentimes start=-1 | eval ReportDate=strftime(now(),"%F %T") | table ReportDate</query>
          <earliest></earliest>
          <latest></latest>
          <done>
            <condition match="'job.resultCount' == 1">
              <set token="rptdate">$result.ReportDate$</set>
            </condition>
             <condition >
               <unset token="rptdate"/>
            </condition>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <center>
          <h8> Today's Date is $rptdate$</h8>
        </center>
      </html>
    </panel>
  </row>
</dashboard>

daishih
Path Finder

This answer does not work 😞 I get the same result

Today's Date is $result.ReportDate$

0 Karma

somesoni2
Revered Legend

What version of Splunk are you using?

0 Karma

_dave_b
Communicator

I get

Today's Date is $result.ReportDate$

0 Karma

_dave_b
Communicator

The problem is the result object isn't de-referencing the ReportDate value as expected. That result object seems key for accessing values from the search.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!