Dashboards & Visualizations

How to populate form input field with result from query?

joeylin
Engager

I have a form with a bunch of graphs, and the form text input is populated with the text "cross.promo.getlist" by default:

crosspromo.getlist crosspromo.getlist

but i want to populate it with the top result from this query:

index="pbr" sourcetype="pbr_client" callMethod="*" | stats count(eval(result="cancelled")) as cancelled count(eval(result="failure")) as failures count as total by callMethod | search cancelled > 5 | search failures > 5 | eval rateCancelled=cancelled*100/total | eval rateFailure=failures*100/total | eval rateTotal=rateCancelled+rateFailure | sort rateTotal desc | fields - total cancelled failures rateTotal

This query gives me a ranking of callMethods (stream.getlist, crosspromo.get), and I'd like to populate the input text box with whatever I get as the top ranked callMethod instead of hardcoding the default value. Is this possible?

Thanks!

Joey
Zynga Inc.

Tags (1)

sideview
SplunkTrust
SplunkTrust

OK. If you switch to using Sideview Utils, this is what the relevant config looks like:

<module name="Search">
  <param name="search"><![CDATA[
    index="pbr" sourcetype="pbr_client" callMethod="" | stats count(eval(result="cancelled")) as cancelled count(eval(result="failure")) as failures count as total by callMethod  | search cancelled > 5 | search failures > 5 | eval rateCancelled=cancelled100/total | eval rateFailure=failures*100/total | eval rateTotal=rateCancelled+rateFailure | sort rateTotal desc | head 1 | fields - total cancelled failures rateTotal
  ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">callMethod</param>
    <module name="TextField">
      <param name="name">callMethod</param>
      <param name="label">your form element label goes here</param>

Basically we run your search, then we tell the ResultsValueSetter module to go get the 'callMethod' value from the first result row, and make it available as a key called $callMethod$ to all downstream modules in the page. The TextField module also happens to have a name matching this key, and by convention it will then recognize the key from above and prepopulate itself to that value.

To have a happy transition you'll want to spend about 20 or 30 minutes reading the Sideview Utils examples first though. The upside is that you won't need to worry about intentions and that most of the complexity you would normally have to deal with in the advanced XML isn't there (assuming you're actually using the equivalent Sideview modules instead of core ones).

You can get the latest versionof the app from http://sideviewapps.com/apps/sideview-utils and after reading the first few pages of docs and examples, you can read the TextField and ResultsValueSetter docs to learn more.

joeylin
Engager

I think it's worth a shot. Please let me know how i can do it. Thanks.

0 Karma

sideview
SplunkTrust
SplunkTrust

I can tell you how to do it with the advanced XML and Sideview Utils, if that's an option for you. It can't be done using the Simple XML though and I don't think it can be done with the core Advanced XML either.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...