All Apps and Add-ons

How to create dynamic variable name?

ma_anand1984
Contributor

we can get query result values by "result[0].column name". can this variable be dynamically created.
in other words, can i dynamically compute number in the brackets based on number of rows?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Not directly no. To back up for other readers, your question is about the HTML module in Sideview Utils.

The HTML module can do a number of useful things, one of which is substitute field values from search results, with tokens like $results[0].fieldName$.

However you cannot make parts of any $foo$ token come from another foo token. At least not directly. And indirectly, yes you can absolutely get to where you want to go.

What you can do, is to lean on the search language a bit.

You can do a fair bit with subsearches and arguably that's the traditional approach.

However with Sideview Utils you have a PostProcess module that can incorporate $foo$ tokens in it's search, and you have the ResultsValueSetter module. Those are each two powerful tools and once you understand the range of what they can do together they become very powerful.

So to take a random example, say you had a search result set and you knew that exactly one of the rows was some special hostname matching some criteria, and for which you wanted to display some statistic somewhere.

you could have a postprocess of

 search hostname="special_*" 

(Feel free to picture less trivial search language criteria here. 😃 )

Underneath that you can have a ResultsValueSetter module configured to pull down the "mySpecialStatistic" field plus any others that you find interesting. Because of the postProcess it will get the field value(s) only for the "special" host. now suddenly that value is just on the client available as $mySpecialStatistic$, etc... Now you can just plug that right into another HTML module, or a Search module, or another PostProcess or whatever.

In another class of cases, you can do weird tricks with streamstats and stats count, to literally get the index of the given row within the underlying search results, pull that number down with ResultsValueSetter as a field called "indexOfMySpecialEvent", then use a postprocess of " | head $indexOfMySpecialEvent$".

And once you get into what the Switcher module can do, as far as then forking into different logic, you have a very strange but powerful little state machine...

If you have any questions or you want any help with a use case, feel free to send me an email at nick at sideviewapps.com.

View solution in original post

ma_anand1984
Contributor

thank you

0 Karma

sideview
SplunkTrust
SplunkTrust

Not directly no. To back up for other readers, your question is about the HTML module in Sideview Utils.

The HTML module can do a number of useful things, one of which is substitute field values from search results, with tokens like $results[0].fieldName$.

However you cannot make parts of any $foo$ token come from another foo token. At least not directly. And indirectly, yes you can absolutely get to where you want to go.

What you can do, is to lean on the search language a bit.

You can do a fair bit with subsearches and arguably that's the traditional approach.

However with Sideview Utils you have a PostProcess module that can incorporate $foo$ tokens in it's search, and you have the ResultsValueSetter module. Those are each two powerful tools and once you understand the range of what they can do together they become very powerful.

So to take a random example, say you had a search result set and you knew that exactly one of the rows was some special hostname matching some criteria, and for which you wanted to display some statistic somewhere.

you could have a postprocess of

 search hostname="special_*" 

(Feel free to picture less trivial search language criteria here. 😃 )

Underneath that you can have a ResultsValueSetter module configured to pull down the "mySpecialStatistic" field plus any others that you find interesting. Because of the postProcess it will get the field value(s) only for the "special" host. now suddenly that value is just on the client available as $mySpecialStatistic$, etc... Now you can just plug that right into another HTML module, or a Search module, or another PostProcess or whatever.

In another class of cases, you can do weird tricks with streamstats and stats count, to literally get the index of the given row within the underlying search results, pull that number down with ResultsValueSetter as a field called "indexOfMySpecialEvent", then use a postprocess of " | head $indexOfMySpecialEvent$".

And once you get into what the Switcher module can do, as far as then forking into different logic, you have a very strange but powerful little state machine...

If you have any questions or you want any help with a use case, feel free to send me an email at nick at sideviewapps.com.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...