Hello all! For the life of me, I can't figure this out. By eval commands in the SPL or in Event handlers. Included is a base test dashboard I have been working on.
Ultimately, I want the output of multiple result.fieldname to be delimited by a new line rather than a comma into an HTML field. That would also not remove any comma's that could be included in the result.
Current result
Desired result
Test Dashboard
<dashboard>
<label>Dashboard token test</label>
<row>
<panel>
<table>
<search>
<done>
<set token="output.field1">$result.field1$</set>
<set token="output.field2">$result.field2$</set>
<set token="output.field3">$result.field3$</set>
</done>
<query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<html>
<pre>
$output.field1$
$output.field2$
$output.field3$
</pre>
</html>
</panel>
</row>
</dashboard>
Thank you!
Is your intent to edit the HTML further, or can you simulate your desired output using the existing table? E.g.:
<dashboard>
<label>Dashboard token test</label>
<row>
<panel>
<html>
<style>
#table1 thead{
display: none;
}
</style>
</html>
<table id="table1">
<search>
<query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3
| transpose
| fields - column</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">none</option>
</table>
</panel>
</row>
</dashboard>