Splunk Search

dynamic valueSuffix tag

fsaporito
Explorer

Hello,

I have this checkbox in my dashboard:

<input type="multiselect" token="t_case" searchWhenChanged="true">
      <label>Cases</label>
      <search base="base">
        <query>| dedup Rule</query>
      </search>
      <delimiter> , </delimiter>
      <fieldForLabel>Rule</fieldForLabel>
      <fieldForValue>Rule</fieldForValue>
      <default>FUAA01,NML02,WML01,WML02</default>
      <valuePrefix>count(eval(Rule="</valuePrefix>
      <valueSuffix>")) AS $value$</valueSuffix>
    </input>

the problem is valueSuffix, it seems cannot be "dynamic" (i.e. the suffix is totally missing because it seems it cannot evaluate $value$ and it's totally lost).
this token is evaluated in a chart command and this should be the final output (with two selected values, for example):

chart count(eval(Rule="FUAA01")) AS FUAA101 , count(eval(Rule="NML02")) AS NML02 over date_month by CustomerID

Is there a way to achieve that, only with XML?

thanks,
Fausto

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

Dashboard Input:

<input type="multiselect" token="t_case" searchWhenChanged="true">
    <label>Cases</label>
    <fieldForLabel>Rule</fieldForLabel>
    <fieldForValue>case</fieldForValue>
    <search base="base">
    <query> 
| dedup Rule 
| mvcombine Rule 
| eval prefix="count(eval(Rule=\"" 
| eval sufix="\")) AS " 
| mvexpand Rule 
| eval case=prefix.Rule.sufix.Rule 
| table case Rule</query>
    </search>
    <delimiter> </delimiter>
    <default>"count(eval(Rule=""FUAA01"")) AS FUAA01","count(eval(Rule=""NML02"")) AS NML02","count(eval(Rule=""WML01"")) AS WML01","count(eval(Rule=""WML02"")) AS WML02"</default>
    </input>

Query:

 | chart $t_case$ over date_month by CustomerID

My sample XML:

<form>
  <label>dynamic token</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="t_case" searchWhenChanged="true">
      <label>Cases</label>
      <fieldForLabel>Rule</fieldForLabel>
      <fieldForValue>case</fieldForValue>
      <search>
        <query>| makeresults
| eval Rule=split("FUAA01,NML02,WML01,WML02",",")
| mvexpand Rule 
| table Rule
| mvcombine Rule
| eval prefix="count(eval(Rule=\""
| eval sufix="\")) AS "
| mvexpand Rule
| eval case=prefix.Rule.sufix.Rule
| table case Rule</query>
      </search>
      <delimiter> </delimiter>
      <default>"count(eval(Rule=""FUAA01"")) AS FUAA01"</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-1y@d"), relative_time(_time,"@d"))
| makecontinuous span=1d _time
| eval Rule=mvindex(split("FUAA01,NML02,WML01,WML02",","),(random() % 4))
| eval CustomerID="ID".(random() % 5 + 1)
| table _time CustomerID Rule
| eval date_month=strftime(_time,"%m")
| chart $t_case$ over date_month by CustomerID</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Hi, @fsaporito
I managed to do it.

View solution in original post

to4kawa
Ultra Champion

Dashboard Input:

<input type="multiselect" token="t_case" searchWhenChanged="true">
    <label>Cases</label>
    <fieldForLabel>Rule</fieldForLabel>
    <fieldForValue>case</fieldForValue>
    <search base="base">
    <query> 
| dedup Rule 
| mvcombine Rule 
| eval prefix="count(eval(Rule=\"" 
| eval sufix="\")) AS " 
| mvexpand Rule 
| eval case=prefix.Rule.sufix.Rule 
| table case Rule</query>
    </search>
    <delimiter> </delimiter>
    <default>"count(eval(Rule=""FUAA01"")) AS FUAA01","count(eval(Rule=""NML02"")) AS NML02","count(eval(Rule=""WML01"")) AS WML01","count(eval(Rule=""WML02"")) AS WML02"</default>
    </input>

Query:

 | chart $t_case$ over date_month by CustomerID

My sample XML:

<form>
  <label>dynamic token</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="t_case" searchWhenChanged="true">
      <label>Cases</label>
      <fieldForLabel>Rule</fieldForLabel>
      <fieldForValue>case</fieldForValue>
      <search>
        <query>| makeresults
| eval Rule=split("FUAA01,NML02,WML01,WML02",",")
| mvexpand Rule 
| table Rule
| mvcombine Rule
| eval prefix="count(eval(Rule=\""
| eval sufix="\")) AS "
| mvexpand Rule
| eval case=prefix.Rule.sufix.Rule
| table case Rule</query>
      </search>
      <delimiter> </delimiter>
      <default>"count(eval(Rule=""FUAA01"")) AS FUAA01"</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-1y@d"), relative_time(_time,"@d"))
| makecontinuous span=1d _time
| eval Rule=mvindex(split("FUAA01,NML02,WML01,WML02",","),(random() % 4))
| eval CustomerID="ID".(random() % 5 + 1)
| table _time CustomerID Rule
| eval date_month=strftime(_time,"%m")
| chart $t_case$ over date_month by CustomerID</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Hi, @fsaporito
I managed to do it.

fsaporito
Explorer

Very very nice solution indeed! Perfect!
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...