Dashboards & Visualizations

How to populate form input field with result from query?

joeylin
Engager

I have a form with a bunch of graphs, and the form text input is populated with the text "cross.promo.getlist" by default:

crosspromo.getlist crosspromo.getlist

but i want to populate it with the top result from this query:

index="pbr" sourcetype="pbr_client" callMethod="*" | stats count(eval(result="cancelled")) as cancelled count(eval(result="failure")) as failures count as total by callMethod | search cancelled > 5 | search failures > 5 | eval rateCancelled=cancelled*100/total | eval rateFailure=failures*100/total | eval rateTotal=rateCancelled+rateFailure | sort rateTotal desc | fields - total cancelled failures rateTotal

This query gives me a ranking of callMethods (stream.getlist, crosspromo.get), and I'd like to populate the input text box with whatever I get as the top ranked callMethod instead of hardcoding the default value. Is this possible?

Thanks!

Joey
Zynga Inc.

Tags (1)

sideview
SplunkTrust
SplunkTrust

OK. If you switch to using Sideview Utils, this is what the relevant config looks like:

<module name="Search">
  <param name="search"><![CDATA[
    index="pbr" sourcetype="pbr_client" callMethod="" | stats count(eval(result="cancelled")) as cancelled count(eval(result="failure")) as failures count as total by callMethod  | search cancelled > 5 | search failures > 5 | eval rateCancelled=cancelled100/total | eval rateFailure=failures*100/total | eval rateTotal=rateCancelled+rateFailure | sort rateTotal desc | head 1 | fields - total cancelled failures rateTotal
  ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">callMethod</param>
    <module name="TextField">
      <param name="name">callMethod</param>
      <param name="label">your form element label goes here</param>

Basically we run your search, then we tell the ResultsValueSetter module to go get the 'callMethod' value from the first result row, and make it available as a key called $callMethod$ to all downstream modules in the page. The TextField module also happens to have a name matching this key, and by convention it will then recognize the key from above and prepopulate itself to that value.

To have a happy transition you'll want to spend about 20 or 30 minutes reading the Sideview Utils examples first though. The upside is that you won't need to worry about intentions and that most of the complexity you would normally have to deal with in the advanced XML isn't there (assuming you're actually using the equivalent Sideview modules instead of core ones).

You can get the latest versionof the app from http://sideviewapps.com/apps/sideview-utils and after reading the first few pages of docs and examples, you can read the TextField and ResultsValueSetter docs to learn more.

joeylin
Engager

I think it's worth a shot. Please let me know how i can do it. Thanks.

0 Karma

sideview
SplunkTrust
SplunkTrust

I can tell you how to do it with the advanced XML and Sideview Utils, if that's an option for you. It can't be done using the Simple XML though and I don't think it can be done with the core Advanced XML either.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...