Developing Dashboards, Views, and Apps for Splunk Web

 


Add a single value

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Add a single value

The single value panel displays a single value from search data. The single value is a great way to show off a single number from a field in your data. For example, if you want a counter of traffic or revenue at the top of your dashboard. You can also change the color of the single button depending on the value of the number it displays, creating a red light/green light visualization.

Single button configuration

The following basic example shows how to add a single value to the dashboard you've been building. Use the <single> tag to add a single value panel.

<dashboard>
 <label>My dashboard</label>
  <row>
    <single>
      <searchName>Daily revenue</searchName>
    </single>
  </row>
</dashboard>

Note that the single value takes its number from the first row/first column of your search data, regardless of the total size of the dataset.

Set the color of the panel

You can change the background color of the single value panel depending on what your search returns. If you want to change colors on your single results panel, set up your search to use the rangemap command, and then add the classField option, set to a value of range:

<single>
  <searchString>index=_internal 404 source="*web_access.log" earliest=-1h |
stats count | rangemap field=count low=0-10 elevated=11-100 default=severe</searchString>
  <title>404s this hour</title>
  <option name="classField">range</option>
</single>

Note: You can use a saved search that includes the rangemap command if you wish (use a searchName rather than a searchString). The single value panel color mappings are controlled by the addition of the classField option, set to range.

Configure button specific options

See Step 3 : add panels for options that are available for all panels. You can also set other configuration options that are only available for single value panels, such as a label to show before and after the value, another view to link to when users click the button, and more. For example, this snippet adds labels before and after the value:

<single>
    <searchString>index="_internal" source="*metrics.log" group="pipeline" | chart sum(cpu_seconds) over processor  | rename sum(cpu_seconds) as TotalCPUseconds | sort 1 -TotalCPUseconds | fields processor</searchString>
    <earliestTime>-60m</earliestTime>
    <option name="beforeLabel">"</option>
    <option name="afterLabel">" is the most active processor</option>
  </single>

The single alue panel supports the following options:

additionalClass = CSS class name

linkView = view

field = field

linkFields = result | beforeLabel | afterLabel

classField = class | severe | elevated | low | None

beforeLabel = text

afterLabel = text

linkSearch = search query

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!