Dashboards & Visualizations

help on token count

jip31
Motivator

hi
In the search below, I am doing a count on 2 token : NbIndHost NbHostProcessSup80

 `CPU` 
| stats dc(host) as NbHostProcessSup80 
| appendcols 
[| inputlookup host.csv |
| stats dc(host) as NbIndHost] 
| eval Perc=round((NbHostProcessSup80/NbIndHost)*100,2) 
| table Perc, NbIndHost NbHostProcessSup80

In my xml, I have added <option name="underLabel">/ $NbIndHost$ machines</option> in order to display the NbIndHost count in my single panel
Now I also want to add the NbHostProcessSup80 count
I am doing <option name="underLabel">$NbHostProcessSup80/ $NbIndHost$ machines</option> but it doesnt works
what is the problem please??

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try like

<dashboard>
  <label>singlevalue</label>
  <row>
    <panel>
      <single>
        <search>
          <query>....your query</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition>
              <set token="NbHostProcessSup80">$result.NbHostProcessSup80$</set>
              <set token="NbIndHost">$result.NbIndHost$</set>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="underLabel">$NbHostProcessSup80$/$NbIndHost$ machine</option>
      </single>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try like

<dashboard>
  <label>singlevalue</label>
  <row>
    <panel>
      <single>
        <search>
          <query>....your query</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition>
              <set token="NbHostProcessSup80">$result.NbHostProcessSup80$</set>
              <set token="NbIndHost">$result.NbIndHost$</set>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="underLabel">$NbHostProcessSup80$/$NbIndHost$ machine</option>
      </single>
    </panel>
  </row>
</dashboard>
0 Karma

jip31
Motivator

Hi perfect thanks!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

Can you please share single view XML?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...