Getting Data In

Passing a variable from search query to title in simple xml

Priya312
Explorer

Hi,
I have created a dashboard in simple xml. The alerts for every day is recorded in a lookup is shown in the dashboard. By default, the last alert will be shown in the panel.
In the title of the panel, i want to add the Date from the lookup like - "Alerts at 3-Sep-14".

Is it possible to pass the variable from the lookup to the panel title?

My code snippet:

 <row>
   <panel>
      <table> 
 <title>Daily Threshold - $Day$</title>
        <searchString>| inputlookup test.csv | search [|inputlookup test.csv | dedup Day | head 1 | table Day | return Day] | table Day,Operator,Alerts </searchString>

I want the Day value in the search query to be displayed as the title of the dashboard panel.

Tags (2)
0 Karma

gokadroid
Motivator

Why don't you use a "hidden" drop down to set a token which will reflect in title. The search in the dropdown should be exactly same as that in the panel.

0 Karma

billself
New Member

Hi Priya312

Did you ever solve this? I want to do something similar, though I have my titles in tags on my panels and want to display the latest value as part of the header to bar charts.

All the best
Bill

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...