All Apps and Add-ons

Using ResultValueSetter with Switcher : stop printing the resultvaluesetter's 'field'

jaydevshelat
Engager

A snippet of my code is below. My problem is that the ResultVaueSetter's 'field' value (in this case the value of 'leaf') is printed by downstream modules (in this case by the table chosen by Switcher) and I cannot find a way of stopping this behavior. Any help is appreciated !

CODE sample:


index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | eval leaf = if(si_coverage_1=="","true","false"

leaf


$leaf$
<!-- 1st Switcher Child -->

index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | transaction testname,pert_id | sort + str(testname) | fields testname,subtest_* | fields - _* | formattable | fields - test_count,INVALID,expected_test_count,test_count_progress

20

25
testname,
none


<!-- 1st Switcher child ends -->
<!-- 2nd Switcher Child -->


index="si_scorecard" pert_id=$pert_id$ si_coverage_0=CASE($click.fields.Block$) | transaction si_coverage_1,pert_id,arc_id maxevents=-1 | fields build,si_coverage_1,testname,pert_id,arc_id,bucket | fields - _* | formattable

<!-- post process data for viewing -->
| fields - build,testname,arc_id,pert_id,Other | fields si_coverage_1,test_count,Compilation,Simulation,* | rename test_count as "Test Count" | rename si_coverage_1 as "Area"

20

25
Area,Test Count,*
row
..... {code continues}

sideview
SplunkTrust
SplunkTrust

Short Answer: Give the Switcher module group=" ". There's a bullet on the first Switcher docs page, that says this but it's easy to miss.

Long Answer: Switcher module relies on the group attributes even though these attributes have meaning in certain legacy Splunksystems. What's happening here is that the dashboard template is seeing the group attribute values and interpreting them as panel headers. To make this go away you just have to put that weird space character group=" " onto the Switcher and it'll go away.

0 Karma

jaydevshelat
Engager

Sweet. Thanks for the quick response! It works now 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...