Dashboards & Visualizations

Access search field for Dashboard title

DerekKing
Path Finder

Hi All,

I have a search that results in 2 fields, that I would like to use as a single value field in my dashboard, and access the second field as a token to be used in either the panel title, or the single value caption.

As an example - My search ends like

| stats count values(fileName) AS fileName

which results in;
count | fileName
31 | derek.txt

Is there a way to access the filename field as a token? I thought I may just be able to use $result.fileName$, but it appears not. I've also tried $result.fileName$ and then using that as my token in the title, but no joy.

To give you an idea, currently my XML looks like

  <title>$result.fileName$</title>
  <single>
    <title></title>
    <search>
      <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">block</option>
    <option name="drilldown">none</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="unitPosition">after</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
    <option name="rangeValues">[0,30,70,100]</option>
    <option name="linkView">search</option>
    <option name="underLabel">$fileName$</option>
  </single>
</panel>

Any thoughts, appreciated.

Derek

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

Try the following, where you have to add a little extra to the <search> element to get the fields. See this link for more details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

Also, your search will currently give you a multi-valued set for fileName (because you use values()). Do you want the single fileName value with the most number of processCount? If so, I would change the search to the following:

search .... | stats sum(processCount) AS Processed by fileName | sort 1 -fileName

  <panel>
  <title>$title$</title>
   <single>
     <search>
       <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query>
       <done>
        <condition match=" 'job.resultCount' > 0">
            <set token="title">$result.fileName$</set>
            <set token="label">$result.fileName$</set>
        </condition>
        <condition>
            <set token="title">"No Data"</set>
            <set token="label">"No Data"</set>
        </condition>
    </done>
     </search>
     <option name="colorBy">value</option>
     <option name="colorMode">block</option>
     <option name="drilldown">none</option>
     <option name="numberPrecision">0</option>
     <option name="showSparkline">1</option>
     <option name="showTrendIndicator">1</option>
     <option name="trendColorInterpretation">standard</option>
     <option name="trendDisplayMode">absolute</option>
     <option name="unitPosition">after</option>
     <option name="useColors">1</option>
     <option name="useThousandSeparators">1</option>
     <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
     <option name="rangeValues">[0,30,70,100]</option>
     <option name="underLabel">$label$</option>
   </single>
 </panel>

View solution in original post

rjthibod
Champion

Try the following, where you have to add a little extra to the <search> element to get the fields. See this link for more details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

Also, your search will currently give you a multi-valued set for fileName (because you use values()). Do you want the single fileName value with the most number of processCount? If so, I would change the search to the following:

search .... | stats sum(processCount) AS Processed by fileName | sort 1 -fileName

  <panel>
  <title>$title$</title>
   <single>
     <search>
       <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query>
       <done>
        <condition match=" 'job.resultCount' > 0">
            <set token="title">$result.fileName$</set>
            <set token="label">$result.fileName$</set>
        </condition>
        <condition>
            <set token="title">"No Data"</set>
            <set token="label">"No Data"</set>
        </condition>
    </done>
     </search>
     <option name="colorBy">value</option>
     <option name="colorMode">block</option>
     <option name="drilldown">none</option>
     <option name="numberPrecision">0</option>
     <option name="showSparkline">1</option>
     <option name="showTrendIndicator">1</option>
     <option name="trendColorInterpretation">standard</option>
     <option name="trendDisplayMode">absolute</option>
     <option name="unitPosition">after</option>
     <option name="useColors">1</option>
     <option name="useThousandSeparators">1</option>
     <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
     <option name="rangeValues">[0,30,70,100]</option>
     <option name="underLabel">$label$</option>
   </single>
 </panel>

Gayatri
Loves-to-Learn Lots

Hi,

@rjthibod will this work in Splunk version 7.6.0, because I have tried it but it still displays $label$ instead of value. Below is my query where I want to fetch TraWeek and should get used as under label in single value chart. Please help me to achieve this.

<row>
<panel>
<title>Transaction points processed</title>
<single>
<search>
<query>index=* sourcetype=member.csv |dedup TraWeek | eventstats max(TraWeek) as Max_TransWeek|where TraWeek=Max_TransWeek|eval PAM1=round(PointsAmountInMillion,2)|timechart latest(PAM1) as TransactionPoints by TraWeek</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
<done>
<condition match=" 'job.resultCount' > 0">
<set token="title">$result.TraWeek$</set>
<set token="label">$result.TraWeek$</set>
</condition>
<condition>
<set token="title">"No Data"</set>
<set token="label">"No Data"</set>
</condition>
</done>
</search>
<option name="drilldown">all</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="underLabel">$label$</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="unit">M</option>
<option name="underLabel">$label$</option>
</single>
</panel>

0 Karma

DerekKing
Path Finder

Brilliant Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...