Dashboards & Visualizations

how to add host value in Panel title or in the caption for single value visualization

kranthimutyala
Path Finder

Hi Guys,

I'm working on a dashboard where i need to show up the count of top 1 host in the single value visualization.
Below is the code i'm using

index=abc
|top limit=1 host
| table count

I need the host value to be displayed in the panel title or in the single value caption.

Thank you

0 Karma
1 Solution

niketn
Legend

@kranthimutyala , try the following run anywhere example based on Splunk's _internal index which runs an independent search query to get the Top Host count and sets the two tokens one for host and other for count.

The count token is used in run anywhere search based on makeresults command. And title is displayed using host token. Please try out and confirm!

<dashboard>
  <label>Single Value with Panel Title</label>
  <!-- Independent search for Single Value Panel and Title of Top Host count -->
  <search>
    <query>index=_internal
| top 1 host  showperc=false
| table host count</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="$job.resultCount$==0">
        <set token="tokHost">Unavailable</set>
        <set token="tokCount">0</set>
      </condition>
      <condition>
        <set token="tokHost">$result.host$</set>
        <set token="tokCount">$result.count$</set>        
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <title>Host $tokHost$ value</title>
      <single>
        <search>
          <query>| makeresults
| fields - _time
| eval count="$tokCount$"
          </query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@kranthimutyala , try the following run anywhere example based on Splunk's _internal index which runs an independent search query to get the Top Host count and sets the two tokens one for host and other for count.

The count token is used in run anywhere search based on makeresults command. And title is displayed using host token. Please try out and confirm!

<dashboard>
  <label>Single Value with Panel Title</label>
  <!-- Independent search for Single Value Panel and Title of Top Host count -->
  <search>
    <query>index=_internal
| top 1 host  showperc=false
| table host count</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="$job.resultCount$==0">
        <set token="tokHost">Unavailable</set>
        <set token="tokCount">0</set>
      </condition>
      <condition>
        <set token="tokHost">$result.host$</set>
        <set token="tokCount">$result.count$</set>        
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <title>Host $tokHost$ value</title>
      <single>
        <search>
          <query>| makeresults
| fields - _time
| eval count="$tokCount$"
          </query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...