Dashboards & Visualizations
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Have result.fieldname with multivalue field be delimiter be a newline rather than comma

saber545
New Member
‎02-28-2021 09:57 PM

Hello all! For the life of me, I can't figure this out. By eval commands in the SPL or in Event handlers. Included is a base test dashboard I have been working on.

Ultimately, I want the output of multiple result.fieldname to be delimited by a new line rather than a comma into an HTML field. That would also not remove any comma's that could be included in the result.

Current result

  • value1,value1,value1
  • value2,value2,value2
  • value3,value3,value3

Desired result

  • value1
  • value1
  • value1
  • value2
  • value2
  • value2
  • value3
  • value3
  • value3

Test Dashboard

<dashboard>
  <label>Dashboard token test</label>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="output.field1">$result.field1$</set>
            <set token="output.field2">$result.field2$</set>
            <set token="output.field3">$result.field3$</set>
          </done>
          <query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
    <html>
      <pre>
        $output.field1$

        $output.field2$

        $output.field3$
        </pre>
    </html>
    </panel>
  </row>
</dashboard>

 

Thank you!

Labels (1)
Labels
0 Karma
Reply

tscroggins
Influencer
‎03-07-2021 03:14 PM

@saber545 

Is your intent to edit the HTML further, or can you simulate your desired output using the existing table? E.g.:

<dashboard>
  <label>Dashboard token test</label>
  <row>
    <panel>
      <html>
        <style>
          #table1 thead{
            display: none;
          }
        </style>
      </html>
      <table id="table1">
        <search>
          <query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3
| transpose
| fields - column</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">none</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Reply
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...