Splunk Search

How to retrieve Chart Title and use it in the search?

dablackgoku1234
New Member

I am wondering if it is possible to get the value of the chart title and use it/reference it in the search?

<panel>
      <single>
        <title>GetUsers</title>
        <search>
          <query>sourcetype="test_suite_result_xml" testCaseName="$chart.title$"</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>

If this is not possible, can one declare a variable within the <panel> tags and reference that variable in the Chart Title and search? What I'm trying to achieve is to have a universal search without any hardcoded values.

Tags (3)
0 Karma

renjith_nair
Legend

You have to set a token in any of the methods described http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/tokens
Since you are not using any input, I would suggest to use search based token, a dummy search also will do.

Hope the below code should give you some pointers.

<dashboard>
  <search id="token_maker">
    <query>|stats count</query>
    <done>
        <set token="srctype">ps</set>
    </done>
  </search>
  <label>My Token</label>
  <row>
    <panel>
      <table>
        <title>Showing sourcetype : $srctype$</title>
        <search>
          <query>index=os earliest=-15m sourcetype=$srctype$ </query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

dablackgoku1234
New Member

Thanks. This works for 1 "set" but I am unable to resuse the same token for different values as I create more searches/charts.

0 Karma

renjith_nair
Legend

The tokens are available for the entire dashboard and you should be able to use it in any searches. Sorry but what you mean by 1 set and reuse the token for different values? The values in the token changes whenever you change your input

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dablackgoku1234
New Member

Yes, I am trying to create a single generic search that can be used in all panels, however, the input would not be a dropdown or textbox. The input will be "hardcoded" either in the chart title or in a token in the background.

0 Karma

renjith_nair
Legend

Just trying to understand your use case here. Are you trying to create a single generic search which can be used in all panels?

Do you have any input panels (dropdown, textbox,etc) ? If yes, I would add a token to the input and set the token based on the value selected and use them in the title as well as search

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...