All Apps and Add-ons

How to create dynamic variable name?

ma_anand1984
Contributor

we can get query result values by "result[0].column name". can this variable be dynamically created.
in other words, can i dynamically compute number in the brackets based on number of rows?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Not directly no. To back up for other readers, your question is about the HTML module in Sideview Utils.

The HTML module can do a number of useful things, one of which is substitute field values from search results, with tokens like $results[0].fieldName$.

However you cannot make parts of any $foo$ token come from another foo token. At least not directly. And indirectly, yes you can absolutely get to where you want to go.

What you can do, is to lean on the search language a bit.

You can do a fair bit with subsearches and arguably that's the traditional approach.

However with Sideview Utils you have a PostProcess module that can incorporate $foo$ tokens in it's search, and you have the ResultsValueSetter module. Those are each two powerful tools and once you understand the range of what they can do together they become very powerful.

So to take a random example, say you had a search result set and you knew that exactly one of the rows was some special hostname matching some criteria, and for which you wanted to display some statistic somewhere.

you could have a postprocess of

 search hostname="special_*" 

(Feel free to picture less trivial search language criteria here. 😃 )

Underneath that you can have a ResultsValueSetter module configured to pull down the "mySpecialStatistic" field plus any others that you find interesting. Because of the postProcess it will get the field value(s) only for the "special" host. now suddenly that value is just on the client available as $mySpecialStatistic$, etc... Now you can just plug that right into another HTML module, or a Search module, or another PostProcess or whatever.

In another class of cases, you can do weird tricks with streamstats and stats count, to literally get the index of the given row within the underlying search results, pull that number down with ResultsValueSetter as a field called "indexOfMySpecialEvent", then use a postprocess of " | head $indexOfMySpecialEvent$".

And once you get into what the Switcher module can do, as far as then forking into different logic, you have a very strange but powerful little state machine...

If you have any questions or you want any help with a use case, feel free to send me an email at nick at sideviewapps.com.

View solution in original post

ma_anand1984
Contributor

thank you

0 Karma

sideview
SplunkTrust
SplunkTrust

Not directly no. To back up for other readers, your question is about the HTML module in Sideview Utils.

The HTML module can do a number of useful things, one of which is substitute field values from search results, with tokens like $results[0].fieldName$.

However you cannot make parts of any $foo$ token come from another foo token. At least not directly. And indirectly, yes you can absolutely get to where you want to go.

What you can do, is to lean on the search language a bit.

You can do a fair bit with subsearches and arguably that's the traditional approach.

However with Sideview Utils you have a PostProcess module that can incorporate $foo$ tokens in it's search, and you have the ResultsValueSetter module. Those are each two powerful tools and once you understand the range of what they can do together they become very powerful.

So to take a random example, say you had a search result set and you knew that exactly one of the rows was some special hostname matching some criteria, and for which you wanted to display some statistic somewhere.

you could have a postprocess of

 search hostname="special_*" 

(Feel free to picture less trivial search language criteria here. 😃 )

Underneath that you can have a ResultsValueSetter module configured to pull down the "mySpecialStatistic" field plus any others that you find interesting. Because of the postProcess it will get the field value(s) only for the "special" host. now suddenly that value is just on the client available as $mySpecialStatistic$, etc... Now you can just plug that right into another HTML module, or a Search module, or another PostProcess or whatever.

In another class of cases, you can do weird tricks with streamstats and stats count, to literally get the index of the given row within the underlying search results, pull that number down with ResultsValueSetter as a field called "indexOfMySpecialEvent", then use a postprocess of " | head $indexOfMySpecialEvent$".

And once you get into what the Switcher module can do, as far as then forking into different logic, you have a very strange but powerful little state machine...

If you have any questions or you want any help with a use case, feel free to send me an email at nick at sideviewapps.com.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...