Splunk Search

How to list values to fields based on userid selected in a drop-down form?

edroche3rd
Explorer

good morning all

So I have a table chart with a drop-down that selects a user and this works fine. When I select a user, it searches our kvstore and brings back records. The fields it brings back values for are "skills, levels, memid". The skills field has 27 or 28 values, levels field has 6 values and memid can be any amount.

After selecting a userid from the drop-down what, I am getting back is a table with column headers "Skills, Levels, Memid" with a record for each skill and level combo for that particular userid. So to put in perspective, 28 skills times 5 levels equals 140 records returned the max return should be 28, one level for each skill. Below is my current search definition. I have tried doing a dedup on skills that sort of works, but gives the same level value for each skill. So I get the 28 records like I am suppose to, but the level for each is "None", the first value in the levels field in the search.

Any help would be awesome!
Thanks
Ed

| inputlookup dojo_dev | search memid = $memid_token$ | eval skills = "netq bmc ehlth netdoc hpnnm splunk trident aternity ngenius sniffer airwave vidconf brocade rivrbd clrpass dns dhcp cisco ciscoworks bna asafwalls paltoaltofwalls xnet certadmin bluecat ldbalf5 webservx150 raisedflrserv" | eval levels = "None White Orange Blue Red Black" | makemv skills | makemv levels | mvexpand skills | mvexpand levels | fields skills, levels, memid
0 Karma
1 Solution

woodcock
Esteemed Legend

I am going just by your subject line; do this:

| inputlookup dojo_dev memid = $memid_token$ | stats values(*) AS *

View solution in original post

0 Karma

woodcock
Esteemed Legend

I am going just by your subject line; do this:

| inputlookup dojo_dev memid = $memid_token$ | stats values(*) AS *
0 Karma

edroche3rd
Explorer

using that template, here is what I did and got what I was looking for 🙂

| inputlookup dojo_dev | search memid = $memid_token$ | fields - memfn - memln - mgr - memid

Now one last twist, can I split the table up based on width of panel

0 Karma

woodcock
Esteemed Legend

You definitely do not need the | search (which I deleted).

If you are asking about a way to prevent wide tables from adding a horizontal scrollbar, I don't know of any way to "paginate" or otherwise prevent a scrollbar.

Don't forget to "Accept" the answer to close the question.

0 Karma

somesoni2
Revered Legend

What is the expected output? If you don't want "None" for levels, what is the criteria to assign levels to skills?

0 Karma

edroche3rd
Explorer

the levels are already assigned when the user is added to the kvstore. So all I need it to do is search for a userid and spit out the skills and the level for that user. Example:

memid = u123

skills levels memid (only here to compare)
brocade White U123
asafirewalls Blue U123
...

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...