All Apps and Add-ons

How to create dynamic variable name?

ma_anand1984
Contributor

we can get query result values by "result[0].column name". can this variable be dynamically created.
in other words, can i dynamically compute number in the brackets based on number of rows?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Not directly no. To back up for other readers, your question is about the HTML module in Sideview Utils.

The HTML module can do a number of useful things, one of which is substitute field values from search results, with tokens like $results[0].fieldName$.

However you cannot make parts of any $foo$ token come from another foo token. At least not directly. And indirectly, yes you can absolutely get to where you want to go.

What you can do, is to lean on the search language a bit.

You can do a fair bit with subsearches and arguably that's the traditional approach.

However with Sideview Utils you have a PostProcess module that can incorporate $foo$ tokens in it's search, and you have the ResultsValueSetter module. Those are each two powerful tools and once you understand the range of what they can do together they become very powerful.

So to take a random example, say you had a search result set and you knew that exactly one of the rows was some special hostname matching some criteria, and for which you wanted to display some statistic somewhere.

you could have a postprocess of

 search hostname="special_*" 

(Feel free to picture less trivial search language criteria here. 😃 )

Underneath that you can have a ResultsValueSetter module configured to pull down the "mySpecialStatistic" field plus any others that you find interesting. Because of the postProcess it will get the field value(s) only for the "special" host. now suddenly that value is just on the client available as $mySpecialStatistic$, etc... Now you can just plug that right into another HTML module, or a Search module, or another PostProcess or whatever.

In another class of cases, you can do weird tricks with streamstats and stats count, to literally get the index of the given row within the underlying search results, pull that number down with ResultsValueSetter as a field called "indexOfMySpecialEvent", then use a postprocess of " | head $indexOfMySpecialEvent$".

And once you get into what the Switcher module can do, as far as then forking into different logic, you have a very strange but powerful little state machine...

If you have any questions or you want any help with a use case, feel free to send me an email at nick at sideviewapps.com.

View solution in original post

ma_anand1984
Contributor

thank you

0 Karma

sideview
SplunkTrust
SplunkTrust

Not directly no. To back up for other readers, your question is about the HTML module in Sideview Utils.

The HTML module can do a number of useful things, one of which is substitute field values from search results, with tokens like $results[0].fieldName$.

However you cannot make parts of any $foo$ token come from another foo token. At least not directly. And indirectly, yes you can absolutely get to where you want to go.

What you can do, is to lean on the search language a bit.

You can do a fair bit with subsearches and arguably that's the traditional approach.

However with Sideview Utils you have a PostProcess module that can incorporate $foo$ tokens in it's search, and you have the ResultsValueSetter module. Those are each two powerful tools and once you understand the range of what they can do together they become very powerful.

So to take a random example, say you had a search result set and you knew that exactly one of the rows was some special hostname matching some criteria, and for which you wanted to display some statistic somewhere.

you could have a postprocess of

 search hostname="special_*" 

(Feel free to picture less trivial search language criteria here. 😃 )

Underneath that you can have a ResultsValueSetter module configured to pull down the "mySpecialStatistic" field plus any others that you find interesting. Because of the postProcess it will get the field value(s) only for the "special" host. now suddenly that value is just on the client available as $mySpecialStatistic$, etc... Now you can just plug that right into another HTML module, or a Search module, or another PostProcess or whatever.

In another class of cases, you can do weird tricks with streamstats and stats count, to literally get the index of the given row within the underlying search results, pull that number down with ResultsValueSetter as a field called "indexOfMySpecialEvent", then use a postprocess of " | head $indexOfMySpecialEvent$".

And once you get into what the Switcher module can do, as far as then forking into different logic, you have a very strange but powerful little state machine...

If you have any questions or you want any help with a use case, feel free to send me an email at nick at sideviewapps.com.

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...