Splunk Search

passing simple search result as token to chart searchstring without any input in a form using simple xml

lahariveerlapat
Explorer

I have a search query which results the top 1 value from a field called "eventtype" and this top 1 value will change time to time since my dashboard is refreshing for every 1 minute.Now I want to pass this top 1 value as a token to my chart searchstring.means I want to run a search automatically when form is loading and passing the searchresult as token Can we do this one using simple xml.

0 Karma

yannK
Splunk Employee
Splunk Employee

recommendation : use a single search with postprocess to populate your top1 table, and the chart.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...