How to pass search result from one Panel to a diff...

_dave_b · ‎03-24-2016

Hello. I'm trying to construct a footer containing my app's version in a dashboard. The footer resides in a different panel. I can find the version from a search, but I haven't found a way to pass that value into the lower panel. It seems like this can be done by using tokens, but my research hasn't revealed a way to do this specifically.

Conceptually, I want the dashboard code to work like this:

Panel1:
<query>| rest /servicesNS/nobody/system/apps/local/ | search title="MyApp" | table title version</query>

Panel2:
< html >< center >< h8 >< img src="/static/app/MyApp/appLogo.png" / > MyApp version $version$< /h8 >< /center >< /html >

Any helpful pointers or references would be greatly appreciated!

Thanks

somesoni2 · ‎03-24-2016

Give this a try (run anywhere sample for Splunk 6.3.x)

<dashboard>
  <label>Token from Search</label> 
  <row>
    <panel>
      <table>
         <search>
          <query>| gentimes start=-1 | eval ReportDate=strftime(now(),"%F %T") | table ReportDate</query>
          <earliest></earliest>
          <latest></latest>
          <done>
            <condition match="'job.resultCount' == 1">
              <set token="rptdate">$result.ReportDate$</set>
            </condition>
             <condition >
               <unset token="rptdate"/>
            </condition>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <center>
          <h8> Today's Date is $rptdate$</h8>
        </center>
      </html>
    </panel>
  </row>
</dashboard>

daishih · ‎08-09-2016

This answer does not work 😞 I get the same result

Today's Date is $result.ReportDate$

somesoni2 · ‎08-09-2016

What version of Splunk are you using?

_dave_b · ‎03-24-2016

I get

Today's Date is $result.ReportDate$

_dave_b · ‎03-24-2016

The problem is the result object isn't de-referencing the ReportDate value as expected. That result object seems key for accessing values from the search.

How to pass search result from one Panel to a different Panel?

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Using Machine Learning for Hunting Security Threats

Observability Newsletter Highlights | March 2023