Dashboards & Visualizations

How to do a simple calculation based on two form values?

apnetmedic
Explorer

I've got two tokens in an input form, let's call them token1 and token2. They are each used to construct some searches, and that's all fine and good.

I'd also like to do a simple calculation based on these, like: someResult = token1 x token2 x someConstant, and display that in a single value panel.

I just can't figure out how to do that without an actual search involved. It's got to be easy... right?

Tags (2)
0 Karma

jlin
Splunk Employee
Splunk Employee

I believe the best way would be to use calculated fields - http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields

In props.conf, you could set up a calculated field such as:


[<stanza>]
EVAL-<field_name> = <eval statement>

which in your case:


[<your_stanza>]
EVAL-someResult = token1 * token2 * <someConstant>

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can create dummy results using gentimes without hitting any actual index/sourcetype.

e.g.

|gentimes start=-1 |  eval someResult = $token1$ * $token2$ * someConstant | table someResult
0 Karma

apnetmedic
Explorer

Even easier is probably something like:
| stats count(_raw) | eval someResult = token1 * token2 * someConstant | table someResult

That spends minimal time on the search, which returns 0 events, then stats count() returns 1 row, and my eval then produces something.

EDIT: took out an initial empty search. @somesoni2 led me there with the | gentimes | idea. That works too, really anything that will generate one row of data to throw away.

0 Karma

Raghav2384
Motivator

Can be achieved using post processing searches.
Make the selections mentioned in the search template, please refer ui examples app.

Once you have the parent search, insert a separate chart panel to do some thing like table someResult.
someResult would be (token1*token2*constant). There might be other ways to do it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...