Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to pass search result from one Panel to a ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to pass search result from one Panel to a different Panel?
Hello. I'm trying to construct a footer containing my app's version in a dashboard. The footer resides in a different panel. I can find the version from a search, but I haven't found a way to pass that value into the lower panel. It seems like this can be done by using tokens, but my research hasn't revealed a way to do this specifically.
Conceptually, I want the dashboard code to work like this:
Panel1:
<query>| rest /servicesNS/nobody/system/apps/local/ | search title="MyApp" | table title version</query>
Panel2:
< html >< center >< h8 >< img src="/static/app/MyApp/appLogo.png" / > MyApp version $version$< /h8 >< /center >< /html >
Any helpful pointers or references would be greatly appreciated!
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try (run anywhere sample for Splunk 6.3.x)
<dashboard>
<label>Token from Search</label>
<row>
<panel>
<table>
<search>
<query>| gentimes start=-1 | eval ReportDate=strftime(now(),"%F %T") | table ReportDate</query>
<earliest></earliest>
<latest></latest>
<done>
<condition match="'job.resultCount' == 1">
<set token="rptdate">$result.ReportDate$</set>
</condition>
<condition >
<unset token="rptdate"/>
</condition>
</done>
</search>
</table>
</panel>
</row>
<row>
<panel>
<html>
<center>
<h8> Today's Date is $rptdate$</h8>
</center>
</html>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This answer does not work 😞 I get the same result
Today's Date is $result.ReportDate$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of Splunk are you using?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I get
Today's Date is $result.ReportDate$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem is the result object isn't de-referencing the ReportDate value as expected. That result object seems key for accessing values from the search.
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
