topic Re: dynamic option in an input panel in Splunk Dev

dynamic option in an input panel

Arnaud1213 — Thu, 09 Mar 2017 09:13:05 GMT

HI all,
I would to build a dynamic value for a dynamic option in an 'dropdown' panel for a dashboard (splunk 6.5.2)

For example my query returns x results in a table : Number1, Number2, Number3 (to give an example with 3 values, but the result is always unknown). It allows to select between these 3 values to build a chart with a query like "index=blabla | timechart $myToken$ by myType". If Number1 is selected, the chart's query is "index=blabla | timechart SUM(Number1) by myType" because I need to draw the SUM.
So my dynamic options have a token prefix "SUM(", and a token prefix ")".

My need is to add a x+1 th (here a 4th) dynamic option "All", so that the resulted query for my chart is "index=blabla | timechart SUM(Number1), SUM(Number2), SUM(Number3) by myType".

How can I do that ?
Thank you,
Arnaud

Re: dynamic option in an input panel

woodcock — Thu, 09 Mar 2017 16:16:32 GMT

You need to do this in your populatingsearch. You can completely control what is returned from this search so you can put the All value in yourself using SPL. Your XML will have a line like this:

<populatingSearch fieldForValue="MyValue" fieldForLabel="MyLabel">
    <![CDATA[index=_* OR index=* | dedup host | table host | rename host AS MyField | eventstats values(MyField) AS MyValue | reverse | appendpipe [|noop|stats count AS MyField|eval MyField="ALL(*)"] | nomv MyValue | rex field=MyValue mode=sed "s/^/SUM(/ s/ /) SUM(/ s/$/)/" | filldown MyValue | reverse | eval MyValue=if(like(MyField, "ALL(*)"), MyValue, "SUM(" . MyField . ")")]]>
</populatingSearch>

Run the search by itself and see what it does. You will need to change host to your field but the gist is that we are controlling EVERYTHING in the replacement string creation and we have manually created the ALL(*) value which includes the SUM strings, too.

Your dashboard panel search will now be this:

index=blabla | timechart $new_token$ BY myType

Re: dynamic option in an input panel

DalJeanis — Thu, 09 Mar 2017 16:35:30 GMT

Take a look at this run-anywhere sample -

| makeresults | eval mydata="Number1 Number2 Number3" 
| makemv mydata | mvexpand mydata | rename mydata as search 
| format "" "sum(" 2 ")" "" ""

...resulting in

sum( Number1 ) sum( Number2 ) sum( Number3 )

Re: dynamic option in an input panel

Arnaud1213 — Fri, 10 Mar 2017 08:57:56 GMT

Hi,
Thank you for your answers.
@Woodcock, I tried your proposition and it works, thank you.
Unfortunately, it takes a long time to get the result. It's not because of your proposition, but because of my query.
So I replaced your initial search by mine " ... | fieldsummary | search field=nb* | dedup field | sort field | table field rename field AS MyField | ...". And it takes a long time because of 'fieldsummary' searching.
Thank you,
Arnaud

Re: dynamic option in an input panel

woodcock — Fri, 10 Mar 2017 15:35:49 GMT

Don't forget to click Accept.