Dashboards & Visualizations

In a dashboard, how do I set a token using the first value from a sort?

barrowvian
Explorer

The first panel in my dashboard shows the amount of unique users for each software package feature version. The search I uses the DC function with the chart command to return the amount of unique users, list them by feature version, and then sort them;

| chart dc(USER_NAME) as "Unique User" BY FEATURE_VERSION
| sort +"Feature Version"

Once the user clicks on a specific version from panel one, I have a second panel on the dashboard which displays the usernames of the individuals. If the user doesn't click on a feature version in panel one, the second panel remains as "No results found".

What I'd like to do is set a token based on the first value from when the sort is produced. So, if that first value is 111 , then the token would be, by default, set to 111.

I'm not sure how to set a token based on that first sorted value. Any help would be much appreciated. Thank you.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@barrowvian,

You can set the token on the search event done or progress for the first panel .

Here is a run anywhere example. As soon as the first panel is done, sourcetype token is set to the first value of the result. This token is then overriden by the clicked value later.

<dashboard>
  <label>First Value Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|chart count by sourcetype|sort +sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <!-- Set result.fieldvalue to the token. done can be replaced by progress as well-->
          <done>
            <set token="sourcetype">$result.sourcetype$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <!-- Same token is used in drilldown also-->
        <drilldown>
          <set token="sourcetype">$row.sourcetype$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* sourcetype=$sourcetype$ |stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@barrowvian,

You can set the token on the search event done or progress for the first panel .

Here is a run anywhere example. As soon as the first panel is done, sourcetype token is set to the first value of the result. This token is then overriden by the clicked value later.

<dashboard>
  <label>First Value Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|chart count by sourcetype|sort +sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <!-- Set result.fieldvalue to the token. done can be replaced by progress as well-->
          <done>
            <set token="sourcetype">$result.sourcetype$</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <!-- Same token is used in drilldown also-->
        <drilldown>
          <set token="sourcetype">$row.sourcetype$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* sourcetype=$sourcetype$ |stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...