Splunk Search

How to retrieve Chart Title and use it in the search?

dablackgoku1234
New Member

I am wondering if it is possible to get the value of the chart title and use it/reference it in the search?

<panel>
      <single>
        <title>GetUsers</title>
        <search>
          <query>sourcetype="test_suite_result_xml" testCaseName="$chart.title$"</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>

If this is not possible, can one declare a variable within the <panel> tags and reference that variable in the Chart Title and search? What I'm trying to achieve is to have a universal search without any hardcoded values.

Tags (3)
0 Karma

renjith_nair
Legend

You have to set a token in any of the methods described http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/tokens
Since you are not using any input, I would suggest to use search based token, a dummy search also will do.

Hope the below code should give you some pointers.

<dashboard>
  <search id="token_maker">
    <query>|stats count</query>
    <done>
        <set token="srctype">ps</set>
    </done>
  </search>
  <label>My Token</label>
  <row>
    <panel>
      <table>
        <title>Showing sourcetype : $srctype$</title>
        <search>
          <query>index=os earliest=-15m sourcetype=$srctype$ </query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

dablackgoku1234
New Member

Thanks. This works for 1 "set" but I am unable to resuse the same token for different values as I create more searches/charts.

0 Karma

renjith_nair
Legend

The tokens are available for the entire dashboard and you should be able to use it in any searches. Sorry but what you mean by 1 set and reuse the token for different values? The values in the token changes whenever you change your input

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dablackgoku1234
New Member

Yes, I am trying to create a single generic search that can be used in all panels, however, the input would not be a dropdown or textbox. The input will be "hardcoded" either in the chart title or in a token in the background.

0 Karma

renjith_nair
Legend

Just trying to understand your use case here. Are you trying to create a single generic search which can be used in all panels?

Do you have any input panels (dropdown, textbox,etc) ? If yes, I would add a token to the input and set the token based on the value selected and use them in the title as well as search

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...