I'd like to do the following in a dashboard using Simple XML (I don't believe I can use advanced XML + post process in my version of Splunk):
1. Run a search that produces a table in panel 1
2. Tokenize a few of the rows in panel A (e.g. row.'<'fieldname'>' for multiple rows, not just the first one)
3. Append the tokenized rows to a table in panel 2
Here is a guess for how to generate the token(s) (step #2):
.....
-what is the "done" tag?
-instead, should I use: `$result.Totals$`?
-any need for a "drilldown" tag?
Here is a guess for how to use the token (step #3):
My guess is that I don't actually need the depends tag -- my query will always produce a result (non-conditional) -- so I'm looking for the simplest way to do this.
I tried to refer to the following examples, but they're a little different from what I need:
- For #1: https://answers.splunk.com/answers/385112/how-to-pass-search-result-from-one-panel-to-a-diff.html
- For #1: https://answers.splunk.com/answers/207240/is-there-a-way-to-create-a-token-from-search-resul.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
- For #2: https://answers.splunk.com/answers/318316/how-many-tokens-can-i-pass-from-one-panel-to-anoth-1.html
↧