topic Re: Producing a csv based on a complex business logic? in Splunk Search

How to produce a csv based on a complex business logic?

danielbb — Thu, 27 Oct 2022 21:32:23 GMT

We have a Splunk UI that allows the users to export a certain set of the rows from a lookup. The caveat is that each row might produce multiple output rows with quite a complex logic.

So, I wonder whether to use the mv set of functions maybe coupled with the map command or to develop a python function to do it.

Any suggestions?

Re: Producing a csv based on a complex business logic?

starcher — Wed, 26 Oct 2022 23:32:46 GMT

Use python. Multi value manipulation can be complex and fragile. With various limitations you will find the hard way.

Re: Producing a csv based on a complex business logic?

gcusello — Thu, 27 Oct 2022 07:08:13 GMT

Hi @danielbb,

as @starcher said, I'd use a python script as the last solution to your need, unless you are a super python expert, and probably I'd avoid in every case!

I'd create a search using all your rules and with this search I'd create a report or a dashboard.

Ciao.

Giusppe

Re: Producing a csv based on a complex business logic?

danielbb — Thu, 27 Oct 2022 20:08:27 GMT

@gcusello @starcher

Thank you for your feedback.

We have a lookup that has the following data and we present it to our users via a dashboard -

number of boxes, customer name, address 3 Alan D. 6 Pixel Rd. TX 5 Yusuf A. 11 Apple Ave. FL 3 Michele Y. 9 Monitor Lake IL

The dashboard user will have a button to create an exportable csv. Based on the number of boxes, the exportable csv will have three rows for Alan, five for Yusuf and three for Michele with their addresses.

Can we do it with SPL?

Re: Producing a csv based on a complex business logic?

johnhuang — Thu, 27 Oct 2022 21:32:03 GMT

Use mvrange to generate a multivalue field with a value for each box, then use mvexpand to create one row for each value.

| makeresults | eval events="3,Alan D.,6 Pixel Rd. TX;5,Yusuf A.,11 Apple Ave. FL;3,Michele Y.,9 Monitor Lake IL" | eval events=split(events, ";") | mvexpand events | rex field=events "^(?<num_of_boxes>[^\,]*)\,(?<customer_name>[^\,]*)\,(?<address>[^\,]*)" | eval item_num=mvrange(1, num_of_boxes+1) | mvexpand item_num | table num_of_boxes customer_name address item_num

Re: Producing a csv based on a complex business logic?

gcusello — Fri, 28 Oct 2022 06:13:46 GMT

Hi @danielbb,

you could create a dashboard with a dropdown input that permits to choose the customer_name and then displays the rows of the lookup related to that name.

then you can export it in csv using the export button in Splunk panels or your custom script.

Ciao.

Giuseppe

Re: Producing a csv based on a complex business logic?

danielbb — Fri, 28 Oct 2022 14:05:48 GMT

Thank you @johnhuan - really neat !!!