Solved: Re: Simple XML - how to handle multiple returned v...

jbp4444 · ‎08-08-2018

I'm trying to send back a table of values to be displayed in an XML dashboard ... I can do it with N separate searches, each returning one value, but there's gotta be a better way.

Something like this:

  <panel id="image_overlay_panel">
      <search id="loc_1s">
          <query>index=wifi_data | lookup wap_lookup WapName as ap_name | stats count by Floor | stats list(count) as foo
          </query>
          <done>
            <set token="loc_1">$result.foo[0]$</set>
            <set token="loc_2">$result.foo[1]$</set>
            <set token="loc_3">$result.foo[2]$</set>
          </done>
      </search>
      <html>
          <div class="map_display">
              <div class="image"></div>
              <div class="singleValue" id="loc_1">$loc_1$</div>
              <div class="singleValue" id="loc_2">$loc_2$</div>
              <div class="singleValue" id="loc_3">$loc_3$</div>
          </div>
      </html>

$result.foo comes back with a comma-sep list of values, but I can't easily pull them apart into the N separate values for the N <div> sections.

Any ideas?

renjith_nair · ‎08-08-2018

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎08-08-2018

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>

---
What goes around comes around. If it helps, hit it with Karma 🙂

jbp4444 · ‎08-08-2018

AHHHH ... I didn't know you could do that inside the XML/eval!

That worked -- thanks for the tip!

renjith_nair · ‎08-08-2018

@jbp4444, Glad it worked 🙂 . Converted to answer. Please accept as answer to close the thread

---
What goes around comes around. If it helps, hit it with Karma 🙂

renjith_nair · ‎08-08-2018

Does mvexpand foo help ?

---
What goes around comes around. If it helps, hit it with Karma 🙂

jbp4444 · ‎08-08-2018

That will just return a different set of results ... still can't pull them apart in the xml/set-token code.

Simple XML - how to handle multiple returned values from search?

Archived Metrics Now Available for APAC and EMEA realms

Detecting Remote Code Executions With the Splunk Threat Research Team

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!