Hi,
When i choose the @m in time picker, the panel title should show as last month. When i change to @w the panel should change to last week.
Note: I even tried created a dummy panel with the below query
eval earliest="@y" | eval test=case(earliest="@y","month",earliest="@mon","Month",earliest="@w","Week") | table test
But am unable to pass the field value to the panel title.
Thanks in advance.
Hello $SathyaNarayanan,
<panel depends="$NotDisplayed$">
Use the set token to set a token with the result of your query
In the end, you should get something like:
<panel depends="$NotDisplayed$">
<table>
<search>
<query><your query></query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<done>
<set token="test">$result.test$</set>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
You can then use the $test$
in the header of your panel
thanks you. It works
Hello $SathyaNarayanan,
<panel depends="$NotDisplayed$">
Use the set token to set a token with the result of your query
In the end, you should get something like:
<panel depends="$NotDisplayed$">
<table>
<search>
<query><your query></query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<done>
<set token="test">$result.test$</set>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
You can then use the $test$
in the header of your panel
Thanks a lot $pote.
I even modified the query and tried form present time picker. It worked.
| eval test=case(earliest="-1y@y","month",earliest="-1mon@mon","Month",earliest="-7d@w0","Week")
can u also help me the list of tokens available like "$result.test$". So that i can use for the future.
@SathyaNarayanan, following are some of the resources to pick up on default/custom tokens to be used in Dashboard:
1) Token Usage in Dashboards
2) Token Reference
3) .Conf 2017 presentations on Tokens: Fields, Indexed Tokens and You
and Tokens in Splunk Web Framework: Use, Abuse and Incantations
4) Developer Gadgets App for Splunk and
5) Splunk Dashboard Examples App for using and viewing tokens
Thank u $niketnilay ,
You are very kind.
As u mentioned "Developer Gadgets App for Splunk" . I have one more doubt, with the use of this app i have created a toggle button and hided the drill down panel.
Now my team even wants the toggle button to disappear from it. Once they click toggle buttont panel.
Hi @SathyaNarayanan,
Try this example which uses both your use cases
<form>
<label>TOKENS_TEST</label>
<fieldset submitButton="false">
<input type="time" token="timer_tok">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Time FromResult : $my_time$ , Time From Time Picker Earliest : $timer_tok.earliest$ , Time From Time Picker Latest :$timer_tok.latest$</title>
<table>
<search>
<query>| makeresults | eval earliest="@y" |eval test=case(earliest="@y","month",earliest="@mon","Month",earliest="@w","Week") | table test</query>
<earliest>-15@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="my_time">$result.test$</set>
</done>
</search>
</table>
</panel>
</row>
</form>