Add a single value
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Add a single value
The single value panel displays a single value from search data. The single value is a great way to show off a single number from a field in your data. For example, if you want a counter of traffic or revenue at the top of your dashboard. You can also change the color of the single button depending on the value of the number it displays, creating a red light/green light visualization.
Single button configuration
The following basic example shows how to add a single value to the dashboard you've been building. Use the <single> tag to add a single value panel.
<dashboard>
<label>My dashboard</label>
<row>
<single>
<searchName>Daily revenue</searchName>
</single>
</row>
</dashboard>
Note that the single value takes its number from the first row/first column of your search data, regardless of the total size of the dataset.
Set the color of the panel
You can change the background color of the single value panel depending on what your search returns. If you want to change colors on your single results panel, set up your search to use the rangemap command, and then add the classField option, set to a value of range:
<single> <searchString>index=_internal 404 source="*web_access.log" earliest=-1h | stats count | rangemap field=count low=0-10 elevated=11-100 default=severe</searchString> <title>404s this hour</title> <option name="classField">range</option> </single>
Note: You can use a saved search that includes the rangemap command if you wish (use a searchName rather than a searchString). The single value panel color mappings are controlled by the addition of the classField option, set to range.
Configure button specific options
See Step 3 : add panels for options that are available for all panels. You can also set other configuration options that are only available for single value panels, such as a label to show before and after the value, another view to link to when users click the button, and more. For example, this snippet adds labels before and after the value:
<single>
<searchString>index="_internal" source="*metrics.log" group="pipeline" | chart sum(cpu_seconds) over processor | rename sum(cpu_seconds) as TotalCPUseconds | sort 1 -TotalCPUseconds | fields processor</searchString>
<earliestTime>-60m</earliestTime>
<option name="beforeLabel">"</option>
<option name="afterLabel">" is the most active processor</option>
</single>
The single alue panel supports the following options:
additionalClass = CSS class name
- An optional additional CSS class name to add to the result container.
linkView = view
- Specify which view to execute the linked search against.
- Defaults to dashboard.
field = field
- Field to display.
- Defaults to first field returned.
linkFields = result | beforeLabel | afterLabel
- Set which part of the text in the single value to use as a link.
- To link the result and both labels, set as result,beforeLabel,afterLabel.
- Defaults to result.
classField = class | severe | elevated | low | None
- Adds the value of the classField of the first result as an additional CSS class to the result container.
- Pre-defined classes include 'severe', 'elevated', 'low', and 'None' (default).
beforeLabel = text
- Label to display before the result.
afterLabel = text
- Label to display after the result.
linkSearch = search query
- Specify a valid complete search query to turn the result into a clickable link.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.