Dashboards & Visualizations

Simple XML - how to handle multiple returned values from search?

jbp4444
Path Finder

I'm trying to send back a table of values to be displayed in an XML dashboard ... I can do it with N separate searches, each returning one value, but there's gotta be a better way.

Something like this:

  <panel id="image_overlay_panel">
      <search id="loc_1s">
          <query>index=wifi_data | lookup wap_lookup WapName as ap_name | stats count by Floor | stats list(count) as foo
          </query>
          <done>
            <set token="loc_1">$result.foo[0]$</set>
            <set token="loc_2">$result.foo[1]$</set>
            <set token="loc_3">$result.foo[2]$</set>
          </done>
      </search>
      <html>
          <div class="map_display">
              <div class="image"></div>
              <div class="singleValue" id="loc_1">$loc_1$</div>
              <div class="singleValue" id="loc_2">$loc_2$</div>
              <div class="singleValue" id="loc_3">$loc_3$</div>
          </div>
      </html>

$result.foo comes back with a comma-sep list of values, but I can't easily pull them apart into the N separate values for the N <div> sections.

Any ideas?

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jbp4444
Path Finder

AHHHH ... I didn't know you could do that inside the XML/eval!

That worked -- thanks for the tip!

0 Karma

renjith_nair
Legend

@jbp4444, Glad it worked 🙂 . Converted to answer. Please accept as answer to close the thread

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Does mvexpand foo help ?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jbp4444
Path Finder

That will just return a different set of results ... still can't pull them apart in the xml/set-token code.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...