Have result.fieldname with multivalue field be del...

saber545 · ‎02-28-2021

Hello all! For the life of me, I can't figure this out. By eval commands in the SPL or in Event handlers. Included is a base test dashboard I have been working on.

Ultimately, I want the output of multiple result.fieldname to be delimited by a new line rather than a comma into an HTML field. That would also not remove any comma's that could be included in the result.

Current result

value1,value1,value1
value2,value2,value2
value3,value3,value3

Desired result

value1
value1
value1

value2
value2
value2

value3
value3
value3

Test Dashboard

<dashboard>
  <label>Dashboard token test</label>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="output.field1">$result.field1$</set>
            <set token="output.field2">$result.field2$</set>
            <set token="output.field3">$result.field3$</set>
          </done>
          <query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
    <html>
      <pre>
        $output.field1$

        $output.field2$

        $output.field3$
        </pre>
    </html>
    </panel>
  </row>
</dashboard>

Thank you!

tscroggins · ‎03-07-2021

@saber545

Is your intent to edit the HTML further, or can you simulate your desired output using the existing table? E.g.:

<dashboard>
  <label>Dashboard token test</label>
  <row>
    <panel>
      <html>
        <style>
          #table1 thead{
            display: none;
          }
        </style>
      </html>
      <table id="table1">
        <search>
          <query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3
| transpose
| fields - column</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">none</option>
      </table>
    </panel>
  </row>
</dashboard>

Have result.fieldname with multivalue field be delimiter be a newline rather than comma

simple XML

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Are you a member of the Splunk Community?