Splunk Search

How to retrieve Chart Title and use it in the search?

dablackgoku1234
New Member

I am wondering if it is possible to get the value of the chart title and use it/reference it in the search?

<panel>
      <single>
        <title>GetUsers</title>
        <search>
          <query>sourcetype="test_suite_result_xml" testCaseName="$chart.title$"</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>

If this is not possible, can one declare a variable within the <panel> tags and reference that variable in the Chart Title and search? What I'm trying to achieve is to have a universal search without any hardcoded values.

Tags (3)
0 Karma

renjith_nair
Legend

You have to set a token in any of the methods described http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/tokens
Since you are not using any input, I would suggest to use search based token, a dummy search also will do.

Hope the below code should give you some pointers.

<dashboard>
  <search id="token_maker">
    <query>|stats count</query>
    <done>
        <set token="srctype">ps</set>
    </done>
  </search>
  <label>My Token</label>
  <row>
    <panel>
      <table>
        <title>Showing sourcetype : $srctype$</title>
        <search>
          <query>index=os earliest=-15m sourcetype=$srctype$ </query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

dablackgoku1234
New Member

Thanks. This works for 1 "set" but I am unable to resuse the same token for different values as I create more searches/charts.

0 Karma

renjith_nair
Legend

The tokens are available for the entire dashboard and you should be able to use it in any searches. Sorry but what you mean by 1 set and reuse the token for different values? The values in the token changes whenever you change your input

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dablackgoku1234
New Member

Yes, I am trying to create a single generic search that can be used in all panels, however, the input would not be a dropdown or textbox. The input will be "hardcoded" either in the chart title or in a token in the background.

0 Karma

renjith_nair
Legend

Just trying to understand your use case here. Are you trying to create a single generic search which can be used in all panels?

Do you have any input panels (dropdown, textbox,etc) ? If yes, I would add a token to the input and set the token based on the value selected and use them in the title as well as search

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...