topic Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML? in Splunk Search

How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

verbal_666 — Sun, 24 May 2020 12:30:14 GMT

Hi.
I would like to know if there is a simple way, via Splunk XML, to create a "for cycle" like routine, to generate panels or rows from a simple SPL search.

A simple example,

I have a lookup my_hosts.csv with a list of hosts (host1 host2 host3)
In a normal way, if I want to make one panel per each host, I need to enter XML code (or make via UI ok) and create every panel manually where, inside, I put my search (ex. search ... host=host1 "critical" | stats count) (x3)
I would like to automatically generate those panels, from a simple |inputlookup my_hosts.csv,
with one single for cycle way, something like this:

for myhost in "| inputlookup my_hosts.csv"; do <---------------
panel
single
title $myhost$ /title
search
search ... host=$myhost$ "critical" | stats count
/search
/single
/panel
done <---------------

Is there a way?
Thanks.

Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

niketn — Sun, 24 May 2020 12:55:29 GMT

@verbal_666 the one panel per host is table or any chart? Can you elaborate? If they are chart you can definitely try Trellis layout!

Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

richgalloway — Sun, 24 May 2020 14:03:50 GMT

Simple XML has no looping constructs.

Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

verbal_666 — Sun, 24 May 2020 18:30:28 GMT

Simple XML has no looping constructs.

Thanks.

Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

niketn — Sun, 24 May 2020 20:04:39 GMT

@verbal_666 if you want to have dynamic single values for each host in the lookup, please try the Trellis Layout feature and confirm. Following is the Splunk Documentation

https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

You will find several examples on Splunk Answers if you search for Trellis Single Value.

Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

verbal_666 — Mon, 25 May 2020 06:25:37 GMT

I surely yet tried the trellis function. I'm not really sure i can apply, inside the trellis, a real layout format, like creating a real PANEL or ROW, since trellis create a single PANEL and formats it as a single search (with page layout with scrolling buttons "< >") splitting each search by a field in a single panel.

I really wanted to create a for cycle in XML, i think it's necessary to convert in html/js the dashboard and work inside it, as a real developer.

Thanks anyway.

Re: How to create "for cycle" routine to generate panels/rows from a search using Splunk XML?

verbal_666 — Mon, 25 May 2020 06:29:29 GMT

I read you, before. Sorry, for no anwser, but trellis resolved partially my "issue". Read next.
Thanks anyway.