Splunk Dev

dynamic option in an input panel

Arnaud1213
Explorer

HI all,
I would to build a dynamic value for a dynamic option in an 'dropdown' panel for a dashboard (splunk 6.5.2)

For example my query returns x results in a table : Number1, Number2, Number3 (to give an example with 3 values, but the result is always unknown). It allows to select between these 3 values to build a chart with a query like "index=blabla | timechart $myToken$ by myType". If Number1 is selected, the chart's query is "index=blabla | timechart SUM(Number1) by myType" because I need to draw the SUM.
So my dynamic options have a token prefix "SUM(", and a token prefix ")".

My need is to add a x+1 th (here a 4th) dynamic option "All", so that the resulted query for my chart is "index=blabla | timechart SUM(Number1), SUM(Number2), SUM(Number3) by myType".

How can I do that ?
Thank you,
Arnaud

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Take a look at this run-anywhere sample -

| makeresults | eval mydata="Number1 Number2 Number3" 
| makemv mydata | mvexpand mydata | rename mydata as search 
| format "" "sum(" 2 ")" "" ""

...resulting in

sum( Number1 ) sum( Number2 ) sum( Number3 )
0 Karma

woodcock
Esteemed Legend

You need to do this in your populatingsearch. You can completely control what is returned from this search so you can put the All value in yourself using SPL. Your XML will have a line like this:

<populatingSearch fieldForValue="MyValue" fieldForLabel="MyLabel">
    <![CDATA[index=_* OR index=* | dedup host | table host | rename host AS MyField | eventstats values(MyField) AS MyValue | reverse | appendpipe [|noop|stats count AS MyField|eval MyField="ALL(*)"] | nomv MyValue | rex field=MyValue mode=sed "s/^/SUM(/ s/ /) SUM(/ s/$/)/" | filldown MyValue | reverse | eval MyValue=if(like(MyField, "ALL(*)"), MyValue, "SUM(" . MyField . ")")]]>
</populatingSearch>

Run the search by itself and see what it does. You will need to change host to your field but the gist is that we are controlling EVERYTHING in the replacement string creation and we have manually created the ALL(*) value which includes the SUM strings, too.

Your dashboard panel search will now be this:

index=blabla | timechart $new_token$ BY myType
0 Karma

Arnaud1213
Explorer

Hi,
Thank you for your answers.
@Woodcock, I tried your proposition and it works, thank you.
Unfortunately, it takes a long time to get the result. It's not because of your proposition, but because of my query.
So I replaced your initial search by mine " ... | fieldsummary | search field=nb* | dedup field | sort field | table field rename field AS MyField | ...". And it takes a long time because of 'fieldsummary' searching.
Thank you,
Arnaud

0 Karma

woodcock
Esteemed Legend

Don't forget to click Accept.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...