Use values from two panels in a third panel

[dbcase]

Hi,

I have 3 single value panels. The first one generates total number of unique logins

index=cox host="cox*" /rest/icontrol/login 200  |rex ".*\"(?<loginid>[^\"]+)\"$"|dedup loginid|stats count

The second one generates the total number of subscribers

index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers cox OR coxtouchstone|stats max(stat_val) as "Subscribers"|eventstats sum(Subscribers) as coxtotal|table coxtotal

What I need to do on the third panel is divide the result from the first panel by the result of the second panel and then display the result. Is there a way to pass a value from a given single value panel into another panel?

[niketn · Accepted solution]

@dbcase, yes using <progress> or <done> search event handlers you can access $result.<fieldName>$ default tokens (provided search result is single row or else it will fetch only first row). In your case it meets this condition since you are using Single value visualization.

Note:

1) <condition match="$job.resultCount$==0"> condition has been used to default token value to 0 when search returns no results.
2) | makeresults returns a result for us to perform division of tokens set in first two panels.
3) <option name="numberPrecision">0.000</option> option increases the digits of precision for third single value which may have division result in fraction.

Following is a run anywhere example for you to try out.

<form>
  <label>Single Value Token</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Panel 1 (Error)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="Error"
| stats count as Error</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <done>
            <condition match="$job.resultCount$==0">
              <set token="tokError">0</set>
            </condition>
            <condition>
              <set token="tokError">$result.Error$</set>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Panel 2 (Warn)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN"
| stats count as Warn</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <done>
            <condition match="$job.resultCount$==0">
              <set token="tokWarn">0</set>
            </condition>
            <condition>
              <set token="tokWarn">$result.Warn$</set>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Panel 3 (Ratio)</title>
        <search>
          <query>| makeresults
| eval ratio=$tokError$/$tokWarn$
| table ratio</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.000</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

PS: Change the search query as per your need in Panel 1 and Panel 2 and perform eval operation in the third panel search query using makeresults, if you just need to perform division as per your question.

You can refer to Splunk Dashboard Examples App on Splunkbase if you want to learn more on setting tokens and also about search event handlers. Following are some of the Splunk doc references:
1) https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults
2) http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Search_event_handlers

[dbcase]

Oh I have a lot to learn, thank you Niketnilay!!!!