All Apps and Add-ons

Using ResultValueSetter with Switcher : stop printing the resultvaluesetter's 'field'

jaydevshelat
Engager

A snippet of my code is below. My problem is that the ResultVaueSetter's 'field' value (in this case the value of 'leaf') is printed by downstream modules (in this case by the table chosen by Switcher) and I cannot find a way of stopping this behavior. Any help is appreciated !

CODE sample:


index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | eval leaf = if(si_coverage_1=="","true","false"

leaf


$leaf$
<!-- 1st Switcher Child -->

index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | transaction testname,pert_id | sort + str(testname) | fields testname,subtest_* | fields - _* | formattable | fields - test_count,INVALID,expected_test_count,test_count_progress

20

25
testname,
none


<!-- 1st Switcher child ends -->
<!-- 2nd Switcher Child -->


index="si_scorecard" pert_id=$pert_id$ si_coverage_0=CASE($click.fields.Block$) | transaction si_coverage_1,pert_id,arc_id maxevents=-1 | fields build,si_coverage_1,testname,pert_id,arc_id,bucket | fields - _* | formattable

<!-- post process data for viewing -->
| fields - build,testname,arc_id,pert_id,Other | fields si_coverage_1,test_count,Compilation,Simulation,* | rename test_count as "Test Count" | rename si_coverage_1 as "Area"

20

25
Area,Test Count,*
row
..... {code continues}

sideview
SplunkTrust
SplunkTrust

Short Answer: Give the Switcher module group=" ". There's a bullet on the first Switcher docs page, that says this but it's easy to miss.

Long Answer: Switcher module relies on the group attributes even though these attributes have meaning in certain legacy Splunksystems. What's happening here is that the dashboard template is seeing the group attribute values and interpreting them as panel headers. To make this go away you just have to put that weird space character group=" " onto the Switcher and it'll go away.

0 Karma

jaydevshelat
Engager

Sweet. Thanks for the quick response! It works now 🙂

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...