Splunk Search

How to retrieve Chart Title and use it in the search?

dablackgoku1234
New Member

I am wondering if it is possible to get the value of the chart title and use it/reference it in the search?

<panel>
      <single>
        <title>GetUsers</title>
        <search>
          <query>sourcetype="test_suite_result_xml" testCaseName="$chart.title$"</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>

If this is not possible, can one declare a variable within the <panel> tags and reference that variable in the Chart Title and search? What I'm trying to achieve is to have a universal search without any hardcoded values.

Tags (3)
0 Karma

renjith_nair
Legend

You have to set a token in any of the methods described http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/tokens
Since you are not using any input, I would suggest to use search based token, a dummy search also will do.

Hope the below code should give you some pointers.

<dashboard>
  <search id="token_maker">
    <query>|stats count</query>
    <done>
        <set token="srctype">ps</set>
    </done>
  </search>
  <label>My Token</label>
  <row>
    <panel>
      <table>
        <title>Showing sourcetype : $srctype$</title>
        <search>
          <query>index=os earliest=-15m sourcetype=$srctype$ </query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

dablackgoku1234
New Member

Thanks. This works for 1 "set" but I am unable to resuse the same token for different values as I create more searches/charts.

0 Karma

renjith_nair
Legend

The tokens are available for the entire dashboard and you should be able to use it in any searches. Sorry but what you mean by 1 set and reuse the token for different values? The values in the token changes whenever you change your input

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dablackgoku1234
New Member

Yes, I am trying to create a single generic search that can be used in all panels, however, the input would not be a dropdown or textbox. The input will be "hardcoded" either in the chart title or in a token in the background.

0 Karma

renjith_nair
Legend

Just trying to understand your use case here. Are you trying to create a single generic search which can be used in all panels?

Do you have any input panels (dropdown, textbox,etc) ? If yes, I would add a token to the input and set the token based on the value selected and use them in the title as well as search

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...