Dashboards & Visualizations

How to edit my dashboard?

sravankaripe
Communicator

i have a Splunk dashboard with panel

alt text

i want to display it as
UserName : kathyk8

for example
alt text

0 Karma

cmerriman
Super Champion

You could eval a new token with that result and then put it into an HTML panel, however if you're generating a PDF, HTML tokens don't generate, so that won't work there. Another option is to create it as a single value, however the text is large, so if that isn't a big deal, then it's always an option.

...
</query>
<preview>
      <set token="token">$result.username$</set>
    </preview>
  </search>
........
<row>
    <panel>
      <html>
          $token$
          </html>
    </panel>
  </row>
0 Karma

woodcock
Esteemed Legend

Do not ask the same question twice. You can edit your question if you need to fix it.:
https://answers.splunk.com/answers/508194/help-me-with-splunk-dashboard-xml.html

woodcock
Esteemed Legend

You will need a custom visualization to remove the table header (modifying the value is trivial). Maybe you can make do with the existing "single value" visualization and it's options.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@sravankaripe - Can you provide your dashboard code and/or search (with any sensitive data anonymized)? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible.

0 Karma

sravankaripe
Communicator

User Details V2

<input type="time" token="field2" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-2h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="multiselect" token="field3" searchWhenChanged="true">
  <label>UserName</label>
  <search>
    <query>--------------- | table UserName | where UserName!=""</query>
    <earliest>$field2.earliest$</earliest>
    <latest>$field2.latest$</latest>
  </search>
  <default></default>
  <!-- <choice value="DSC_*">DSC_*</choice>  -->
  <fieldForLabel>UserName</fieldForLabel>
  <fieldForValue>UserName</fieldForValue>
  <selectFirstChoice>true</selectFirstChoice>
</input>


<query>------------------- | table UserName | where UserName!=""</query>
      <earliest>$field2.earliest$</earliest>
      <latest>$field2.latest$</latest>
      <finalized>
        <set token="ThisIsMyToken">$result.UserName$</set>
      </finalized>
    </search>
    <option name="wrap">undefined</option>
    <option name="rowNumbers">undefined</option>
    <option name="drilldown">row</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>
0 Karma

niketn
Legend

@sravankaripe... based on your code sample it is a bit confusing as to what you are trying to do...

First you have multiselect input with the query to populate UserName (it implies your search returns multiple results). Then you have a table with same search where you are setting token through result.UserName. (this will always pick single value either from single result or first row of multiple results.

Can you please confirm whether your search will return single result or multiple? Can you provide a context of what you want from the two searches? and why exactly you need output like UserName : Kathy8?

Meanwhile your search should ideally run better if rearrange final two pieces like the following:

<your base search> search UserName!="" | table UserName
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...