topic How to add a static value to a table with one column? in Splunk Search

How to add a static value to a table with one column?

brajaram — Thu, 08 Mar 2018 22:45:12 GMT

I'm trying to add a single value to a table I use to dynamically populate a selector in a dashboard. The search I use to populate the dropdown is:

index=initial search|dedup pageURL| table pageURL

I want to add to the end of the search something that can be a * value. The reason for this is that in my dashboards built off of the input, I use $pageURL$ to allow viewers to select the specific page they wish to see stats for. However, I want a specific value where I set pageURL=*so that viewers can see what all the pages look like. I tried doing the following as the search to populate the dropdown:

But that didn't add a value of * to the end of the table. Is there a way I can do this?

Re: How to add a static value to a table with one column?

livehybrid — Thu, 08 Mar 2018 22:48:24 GMT

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

Re: How to add a static value to a table with one column?

maciep — Thu, 08 Mar 2018 22:56:46 GMT

Also, if I understand what you're asking correctly, I typically add a manual entry to the input as well. You can call that one "All" and give it a value of *. So then your users would have an All option in the dropdown along with each pageURL from your dynamic search.

That's might be a bit easier than trying to append it to your dynamic search.

Re: How to add a static value to a table with one column?

brajaram — Thu, 08 Mar 2018 23:08:55 GMT

I didn't even think about adding a static value, thanks! That does seem a lot more efficient.

Re: How to add a static value to a table with one column?

livehybrid — Thu, 08 Mar 2018 23:17:40 GMT

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults!