All Apps and Add-ons

Using ResultValueSetter with Switcher : stop printing the resultvaluesetter's 'field'

jaydevshelat
Engager

A snippet of my code is below. My problem is that the ResultVaueSetter's 'field' value (in this case the value of 'leaf') is printed by downstream modules (in this case by the table chosen by Switcher) and I cannot find a way of stopping this behavior. Any help is appreciated !

CODE sample:


index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | eval leaf = if(si_coverage_1=="","true","false"

leaf


$leaf$
<!-- 1st Switcher Child -->

index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | transaction testname,pert_id | sort + str(testname) | fields testname,subtest_* | fields - _* | formattable | fields - test_count,INVALID,expected_test_count,test_count_progress

20

25
testname,
none


<!-- 1st Switcher child ends -->
<!-- 2nd Switcher Child -->


index="si_scorecard" pert_id=$pert_id$ si_coverage_0=CASE($click.fields.Block$) | transaction si_coverage_1,pert_id,arc_id maxevents=-1 | fields build,si_coverage_1,testname,pert_id,arc_id,bucket | fields - _* | formattable

<!-- post process data for viewing -->
| fields - build,testname,arc_id,pert_id,Other | fields si_coverage_1,test_count,Compilation,Simulation,* | rename test_count as "Test Count" | rename si_coverage_1 as "Area"

20

25
Area,Test Count,*
row
..... {code continues}

sideview
SplunkTrust
SplunkTrust

Short Answer: Give the Switcher module group=" ". There's a bullet on the first Switcher docs page, that says this but it's easy to miss.

Long Answer: Switcher module relies on the group attributes even though these attributes have meaning in certain legacy Splunksystems. What's happening here is that the dashboard template is seeing the group attribute values and interpreting them as panel headers. To make this go away you just have to put that weird space character group=" " onto the Switcher and it'll go away.

0 Karma

jaydevshelat
Engager

Sweet. Thanks for the quick response! It works now 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...