- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to pass search result from one Panel to a ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to pass search result from one Panel to a different Panel?
Hello. I'm trying to construct a footer containing my app's version in a dashboard. The footer resides in a different panel. I can find the version from a search, but I haven't found a way to pass that value into the lower panel. It seems like this can be done by using tokens, but my research hasn't revealed a way to do this specifically.
Conceptually, I want the dashboard code to work like this:
Panel1:
<query>| rest /servicesNS/nobody/system/apps/local/ | search title="MyApp" | table title version</query>
Panel2:
< html >< center >< h8 >< img src="/static/app/MyApp/appLogo.png" / > MyApp version $version$< /h8 >< /center >< /html >
Any helpful pointers or references would be greatly appreciated!
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try (run anywhere sample for Splunk 6.3.x)
<dashboard>
<label>Token from Search</label>
<row>
<panel>
<table>
<search>
<query>| gentimes start=-1 | eval ReportDate=strftime(now(),"%F %T") | table ReportDate</query>
<earliest></earliest>
<latest></latest>
<done>
<condition match="'job.resultCount' == 1">
<set token="rptdate">$result.ReportDate$</set>
</condition>
<condition >
<unset token="rptdate"/>
</condition>
</done>
</search>
</table>
</panel>
</row>
<row>
<panel>
<html>
<center>
<h8> Today's Date is $rptdate$</h8>
</center>
</html>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This answer does not work 😞 I get the same result
Today's Date is $result.ReportDate$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of Splunk are you using?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I get
Today's Date is $result.ReportDate$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem is the result object isn't de-referencing the ReportDate value as expected. That result object seems key for accessing values from the search.
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
