Solved: Re: Simple XML - how to handle multiple returned v...

jbp4444 · ‎08-08-2018

I'm trying to send back a table of values to be displayed in an XML dashboard ... I can do it with N separate searches, each returning one value, but there's gotta be a better way.

Something like this:

  <panel id="image_overlay_panel">
      <search id="loc_1s">
          <query>index=wifi_data | lookup wap_lookup WapName as ap_name | stats count by Floor | stats list(count) as foo
          </query>
          <done>
            <set token="loc_1">$result.foo[0]$</set>
            <set token="loc_2">$result.foo[1]$</set>
            <set token="loc_3">$result.foo[2]$</set>
          </done>
      </search>
      <html>
          <div class="map_display">
              <div class="image"></div>
              <div class="singleValue" id="loc_1">$loc_1$</div>
              <div class="singleValue" id="loc_2">$loc_2$</div>
              <div class="singleValue" id="loc_3">$loc_3$</div>
          </div>
      </html>

$result.foo comes back with a comma-sep list of values, but I can't easily pull them apart into the N separate values for the N <div> sections.

Any ideas?

renjith_nair · ‎08-08-2018

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎08-08-2018

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>

---
What goes around comes around. If it helps, hit it with Karma 🙂

jbp4444 · ‎08-08-2018

AHHHH ... I didn't know you could do that inside the XML/eval!

That worked -- thanks for the tip!

renjith_nair · ‎08-08-2018

@jbp4444, Glad it worked 🙂 . Converted to answer. Please accept as answer to close the thread

---
What goes around comes around. If it helps, hit it with Karma 🙂

renjith_nair · ‎08-08-2018

Does mvexpand foo help ?

---
What goes around comes around. If it helps, hit it with Karma 🙂

jbp4444 · ‎08-08-2018

That will just return a different set of results ... still can't pull them apart in the xml/set-token code.

Simple XML - how to handle multiple returned values from search?

Detecting Remote Code Executions With the Splunk Threat Research Team

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

.conf24 | Session Scheduler is Live!!