Splunk Search

How To Use The Result Of Query ( Single Panel ) In A Radio Button Text?

vtsguerrero
Contributor

Hello guys!

I needed to use a single panel to show three status, green, yellow and red.
But the problem is, a row with three single panels got too big for the dashboard.
So I was asked to display this stats count based inside the same input (radio) that filters the search:
For example

[label]Status:[/label]

[input radio button]Green: ( Total Count 2 )[/input radio button]
[input radio button]Yellow: ( Total Count 8 )[/input radio button]
[input radio button]Red: ( Total Count 1 )[/input radio button]

Can I use the result of a query inside the text of an input or label of this input?
Thanks in advance!

0 Karma

jeffland
SplunkTrust
SplunkTrust

I don't know if you can use the result of a search directly (especially since the search needs to finish befor that result can be used), but you can certainly change the text of your radio button with jquery once the search is done. I'm thinking of something like

var search = splunkjs.mvc.Components.getInstance("count_search"); // get your search here
var myResults = search.data("results"); // get those results from the search
var resultArray = []; // prepare an array for the rows of results
var radios = $(".splunk-radiogroup-choices").find("label"); // this gets you all labels that are descendants of the class splunk-radiogroup-choices
var labelArray = [ "Green ", "Yellow ", "Red "]; // this can be used to label your buttons

myResults.on("data", function() {
    resultArray = myResults.data().rows; // fetch rows
    for (var i = 0; i < 3; i++) {
        radios[i].textContent = labelArray[i] + " (Total count: " + resultArray[i][1] +")"; // replace the text of your buttons
    }
});

This works assuming you have only one radiobutton group, otherwise you'll have to specify your buttons differently. Also this assumes your results are always returned in the order green - yellow - red, but it could also make sense to use text based on the result from your search here (i.e. if your search returns a column with color names in it, you could use that instead of labelArray[i], such as resultArray[i][0]). You should probably make your initial button labels look something like "Green (Total count: ...)" or something like that to indicate a search is running.

Hope this works for you.

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...