<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Is it possible to set a token with the value of the nth row of a result set? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499233#M32689</link>
    <description>&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval _raw="fruit,amount
Apple,54
Pear,2
Cantaloupe,5000
Strawberry,1"
| multikv forceheader=1 
| sort -amount
| table fruit amount
| head 3
| transpose
| rename "row *" as row*
| head 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;HR /&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;done&amp;gt;
    &amp;lt;set token="tok_first"&amp;gt;$result.row1$&amp;lt;/set&amp;gt;
    &amp;lt;set token="tok_second"&amp;gt;$result.row2$&amp;lt;/set&amp;gt;
    &amp;lt;set token="tok_third"&amp;gt;$result.row3$&amp;lt;/set&amp;gt;
 &amp;lt;/done&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Is this it?&lt;/P&gt;</description>
    <pubDate>Fri, 29 Nov 2019 14:49:29 GMT</pubDate>
    <dc:creator>to4kawa</dc:creator>
    <dc:date>2019-11-29T14:49:29Z</dc:date>
    <item>
      <title>Is it possible to set a token with the value of the nth row of a result set?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499230#M32686</link>
      <description>&lt;P&gt;Hello All,&lt;/P&gt;

&lt;P&gt;Using this run anywhere for reference:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval fruit = "Apple", amount=54
| append [ | makeresults
 | eval fruit = "Pear", amount=2 ]
| append [ | makeresults
 | eval fruit = "Cantaloupe", amount=5000 ]
| append [ | makeresults
 | eval fruit = "Strawberry", amount=1 ]
 | sort -amount
 | table fruit amount
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;My objective is to set three tokens with the names of the three fruits with the highest counts (in this case Canteloupe, Apple, Pear) three separate values after the above search completes in a dashboard.  I am using the &lt;CODE&gt;&amp;lt;done&amp;gt;&lt;/CODE&gt; tag to invoke the procedure, but I am having difficulty figuring out how to get it to work.  If I set drilldown as follows I can click the value I want:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;drilldown&amp;gt;
   &amp;lt;set token="tok_first"&amp;gt;$row.fruit$&amp;lt;/set&amp;gt;
&amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;What I'd like to do is take it one step further and have the first three rows get associated to tokens automatically.  Something along the lines of:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;done&amp;gt;
   &amp;lt;set token="tok_first"&amp;gt;$row[0].fruit$&amp;lt;/set&amp;gt;
   &amp;lt;set token="tok_second"&amp;gt;$row[1].fruit$&amp;lt;/set&amp;gt;
   &amp;lt;set token="tok_third"&amp;gt;$row[2].fruit$&amp;lt;/set&amp;gt;
&amp;lt;/done&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Is this possible?&lt;/P&gt;

&lt;P&gt;Thanks!&lt;/P&gt;

&lt;P&gt;Andrew&lt;/P&gt;</description>
      <pubDate>Fri, 29 Nov 2019 14:00:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499230#M32686</guid>
      <dc:creator>andrewtrobec</dc:creator>
      <dc:date>2019-11-29T14:00:51Z</dc:date>
    </item>
    <item>
      <title>Re: Is it possible to set a token with the value of the nth row of a result set?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499231#M32687</link>
      <description>&lt;P&gt;One option would be to use head and transpose:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval fruit = "Apple", amount=54
| append [ | makeresults
| eval fruit = "Pear", amount=2 ]
| append [ | makeresults
| eval fruit = "Cantaloupe", amount=5000 ]
| append [ | makeresults
| eval fruit = "Strawberry", amount=1 ]
| sort -amount
| table fruit amount
| head 3 | transpose | head 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This will give you fields row1, row2, and row3 which can then be tokenized.&lt;/P&gt;</description>
      <pubDate>Fri, 29 Nov 2019 14:21:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499231#M32687</guid>
      <dc:creator>jpolvino</dc:creator>
      <dc:date>2019-11-29T14:21:33Z</dc:date>
    </item>
    <item>
      <title>Re: Is it possible to set a token with the value of the nth row of a result set?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499232#M32688</link>
      <description>&lt;P&gt;@jpolvino Clever!  This has solved my problem, thank you!&lt;/P&gt;</description>
      <pubDate>Fri, 29 Nov 2019 14:47:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499232#M32688</guid>
      <dc:creator>andrewtrobec</dc:creator>
      <dc:date>2019-11-29T14:47:37Z</dc:date>
    </item>
    <item>
      <title>Re: Is it possible to set a token with the value of the nth row of a result set?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499233#M32689</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval _raw="fruit,amount
Apple,54
Pear,2
Cantaloupe,5000
Strawberry,1"
| multikv forceheader=1 
| sort -amount
| table fruit amount
| head 3
| transpose
| rename "row *" as row*
| head 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;HR /&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;done&amp;gt;
    &amp;lt;set token="tok_first"&amp;gt;$result.row1$&amp;lt;/set&amp;gt;
    &amp;lt;set token="tok_second"&amp;gt;$result.row2$&amp;lt;/set&amp;gt;
    &amp;lt;set token="tok_third"&amp;gt;$result.row3$&amp;lt;/set&amp;gt;
 &amp;lt;/done&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Is this it?&lt;/P&gt;</description>
      <pubDate>Fri, 29 Nov 2019 14:49:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-set-a-token-with-the-value-of-the-nth-row-of-a/m-p/499233#M32689</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2019-11-29T14:49:29Z</dc:date>
    </item>
  </channel>
</rss>

