Dashboards & Visualizations

Have result.fieldname with multivalue field be delimiter be a newline rather than comma

saber545
New Member

Hello all! For the life of me, I can't figure this out. By eval commands in the SPL or in Event handlers. Included is a base test dashboard I have been working on.

Ultimately, I want the output of multiple result.fieldname to be delimited by a new line rather than a comma into an HTML field. That would also not remove any comma's that could be included in the result.

Current result

  • value1,value1,value1
  • value2,value2,value2
  • value3,value3,value3

Desired result

  • value1
  • value1
  • value1
  • value2
  • value2
  • value2
  • value3
  • value3
  • value3

Test Dashboard

<dashboard>
  <label>Dashboard token test</label>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="output.field1">$result.field1$</set>
            <set token="output.field2">$result.field2$</set>
            <set token="output.field3">$result.field3$</set>
          </done>
          <query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
    <html>
      <pre>
        $output.field1$

        $output.field2$

        $output.field3$
        </pre>
    </html>
    </panel>
  </row>
</dashboard>

 

Thank you!

Labels (1)
0 Karma

tscroggins
Influencer

@saber545 

Is your intent to edit the HTML further, or can you simulate your desired output using the existing table? E.g.:

<dashboard>
  <label>Dashboard token test</label>
  <row>
    <panel>
      <html>
        <style>
          #table1 thead{
            display: none;
          }
        </style>
      </html>
      <table id="table1">
        <search>
          <query>index=* sourcetype=*
| head 40
| stats values(field1) as field1 values(field2) as field2 values(field3) as field3
| transpose
| fields - column</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">none</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...