All Apps and Add-ons

Using ResultValueSetter with Switcher : stop printing the resultvaluesetter's 'field'

jaydevshelat
Engager

A snippet of my code is below. My problem is that the ResultVaueSetter's 'field' value (in this case the value of 'leaf') is printed by downstream modules (in this case by the table chosen by Switcher) and I cannot find a way of stopping this behavior. Any help is appreciated !

CODE sample:


index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | eval leaf = if(si_coverage_1=="","true","false"

leaf


$leaf$
<!-- 1st Switcher Child -->

index="si_scorecard" pert_id=$pert_id.value$ si_coverage_0="$click.fields.Block$" | transaction testname,pert_id | sort + str(testname) | fields testname,subtest_* | fields - _* | formattable | fields - test_count,INVALID,expected_test_count,test_count_progress

20

25
testname,
none


<!-- 1st Switcher child ends -->
<!-- 2nd Switcher Child -->


index="si_scorecard" pert_id=$pert_id$ si_coverage_0=CASE($click.fields.Block$) | transaction si_coverage_1,pert_id,arc_id maxevents=-1 | fields build,si_coverage_1,testname,pert_id,arc_id,bucket | fields - _* | formattable

<!-- post process data for viewing -->
| fields - build,testname,arc_id,pert_id,Other | fields si_coverage_1,test_count,Compilation,Simulation,* | rename test_count as "Test Count" | rename si_coverage_1 as "Area"

20

25
Area,Test Count,*
row
..... {code continues}

sideview
SplunkTrust
SplunkTrust

Short Answer: Give the Switcher module group=" ". There's a bullet on the first Switcher docs page, that says this but it's easy to miss.

Long Answer: Switcher module relies on the group attributes even though these attributes have meaning in certain legacy Splunksystems. What's happening here is that the dashboard template is seeing the group attribute values and interpreting them as panel headers. To make this go away you just have to put that weird space character group=" " onto the Switcher and it'll go away.

0 Karma

jaydevshelat
Engager

Sweet. Thanks for the quick response! It works now 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...