source="something_source" topic="something_topic1" OR topic="something_topic2" OR topic="something_topic3" client="cpu1305" | stats latest(msg) as Valuess by topic
Now this search returns something like below:
**topic** **Valuess**
something_topic1 3
something_topic2 7
something_topic3 8
So, if I write something like below in my Splunk dashboard inside <search> tag:
<done>
<set token="chkStatShow">$result.Values$</set>
</done>
This only returns first row i.e. '3', but I need to access remaining rows as well.
How do I achieve this?
@avisriv
Do you want all values
in single chkStatShow
token? with comma separated or multivalue?
Multivalue if possible, would be great. Thanks!
Can you please try this?
source="something_source" topic="something_topic1" OR topic="something_topic2" OR topic="something_topic3" client="cpu1305" | stats latest(msg) as Valuess by topic | eventstats values(Valuess) as Valuess
but how do i access these values in my <done> tag ?
<done>
<set token="chkStatShow">$result.Values$</set>
</done>
Like above only gives 1st row 'Valuess', so how to modify this
I have just created new field Valuess
to get token.
<query>source="something_source" topic="something_topic1" OR topic="something_topic2" OR topic="something_topic3" client="cpu1305" | stats latest(msg) as Values by topic | eventstats values(Values) as Valuess</query>
<done>
<set token="chkStatShow">$result.Valuess$</set>
</done>