Dashboards & Visualizations

Is there a way to use radio buttons to select a range of results/values?

jkcadaing
New Member

Good morning Splunkers!

I need help sorting through a list of MAC Addresses. I have a dashboard that lists them in a drilldown table. I have some list of 900 MAC Addresses and using the command below helps me pass the search results to another instance of Splunk to insert them into a search.

However, I am getting 414 errors for the URI being too long if there are more than 120 MAC Addresses used.

| eval MAC_UNIT=replace(MacAddress, "(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})", "\1:\2:\3:\4:\5:\6") 
| fields MAC_UNIT 
| format

My question: is there a way to select a range of values/results? I'd like to use radio buttons to select results 0-100, 101-200, 201-300, etc.

0 Karma
1 Solution

integratorz
Path Finder

You could use a search command like accum to number the lines and allow you to further your search.

For example:

your search... | eval number=1 | accum number | where number < 100 AND number > 0

This should look like this

1 MAC1
2 MAC2
3 MAC3
...
900 MAC900

This allows you to pick which range you want to send over and ensure its less than 120.

View solution in original post

0 Karma

lakshman239
Influencer

In the dashboard, you would probably want to create a radio button (to simulate range of MAC's using patterns of mac address). Alternatively, if you can have them in a lookuptable with macaddress, id , where id is from 1 to 900 and macaddress is your macaddr. In the drill-down you can look for macaddress from id=1 to id<99 etc..

0 Karma

integratorz
Path Finder

You could use a search command like accum to number the lines and allow you to further your search.

For example:

your search... | eval number=1 | accum number | where number < 100 AND number > 0

This should look like this

1 MAC1
2 MAC2
3 MAC3
...
900 MAC900

This allows you to pick which range you want to send over and ensure its less than 120.

0 Karma

jkcadaing
New Member

Sweet! This helps give them a unique number aka ID and I can use change conditions on the backend and play around with tokens to get the results I need! Thanks a bunch!

0 Karma

integratorz
Path Finder

Any time @jkcadaing! Best of luck and Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...