Dashboards & Visualizations

How to get remaining rows returned by search query? result token only returns first row!!

New Member
 source="something_source" topic="something_topic1" OR topic="something_topic2" OR topic="something_topic3" client="cpu1305" | stats latest(msg) as Valuess by topic

Now this search returns something like below:

  **topic**                       **Valuess**
  something_topic1                3
  something_topic2                7
  something_topic3                8

So, if I write something like below in my Splunk dashboard inside <search> tag:

<done>
  <set token="chkStatShow">$result.Values$</set>
</done>

This only returns first row i.e. '3', but I need to access remaining rows as well.
How do I achieve this?

0 Karma

SplunkTrust
SplunkTrust

@avisriv

Do you want all values in single chkStatShow token? with comma separated or multivalue?

0 Karma

New Member

Multivalue if possible, would be great. Thanks!

0 Karma

SplunkTrust
SplunkTrust

Can you please try this?

source="something_source" topic="something_topic1" OR topic="something_topic2" OR topic="something_topic3" client="cpu1305" | stats latest(msg) as Valuess by topic | eventstats values(Valuess) as Valuess

0 Karma

New Member
but how do i access these values in my <done> tag ?
 <done>
   <set token="chkStatShow">$result.Values$</set>
 </done>
Like above only gives 1st row 'Valuess', so how to modify this
0 Karma

SplunkTrust
SplunkTrust

I have just created new field Valuess to get token.

  <query>source="something_source" topic="something_topic1" OR topic="something_topic2" OR topic="something_topic3" client="cpu1305" | stats latest(msg) as Values by topic | eventstats values(Values) as Valuess</query>
       <done>
            <set token="chkStatShow">$result.Valuess$</set>
        </done>
0 Karma