Splunk Search

How to retrieve Chart Title and use it in the search?

dablackgoku1234
New Member

I am wondering if it is possible to get the value of the chart title and use it/reference it in the search?

<panel>
      <single>
        <title>GetUsers</title>
        <search>
          <query>sourcetype="test_suite_result_xml" testCaseName="$chart.title$"</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>

If this is not possible, can one declare a variable within the <panel> tags and reference that variable in the Chart Title and search? What I'm trying to achieve is to have a universal search without any hardcoded values.

Tags (3)
0 Karma

renjith_nair
Legend

You have to set a token in any of the methods described http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/tokens
Since you are not using any input, I would suggest to use search based token, a dummy search also will do.

Hope the below code should give you some pointers.

<dashboard>
  <search id="token_maker">
    <query>|stats count</query>
    <done>
        <set token="srctype">ps</set>
    </done>
  </search>
  <label>My Token</label>
  <row>
    <panel>
      <table>
        <title>Showing sourcetype : $srctype$</title>
        <search>
          <query>index=os earliest=-15m sourcetype=$srctype$ </query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

dablackgoku1234
New Member

Thanks. This works for 1 "set" but I am unable to resuse the same token for different values as I create more searches/charts.

0 Karma

renjith_nair
Legend

The tokens are available for the entire dashboard and you should be able to use it in any searches. Sorry but what you mean by 1 set and reuse the token for different values? The values in the token changes whenever you change your input

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dablackgoku1234
New Member

Yes, I am trying to create a single generic search that can be used in all panels, however, the input would not be a dropdown or textbox. The input will be "hardcoded" either in the chart title or in a token in the background.

0 Karma

renjith_nair
Legend

Just trying to understand your use case here. Are you trying to create a single generic search which can be used in all panels?

Do you have any input panels (dropdown, textbox,etc) ? If yes, I would add a token to the input and set the token based on the value selected and use them in the title as well as search

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...