Dashboards & Visualizations
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Simple XML - how to handle multiple returned v...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jbp4444
Path Finder
08-08-2018
06:36 AM
I'm trying to send back a table of values to be displayed in an XML dashboard ... I can do it with N separate searches, each returning one value, but there's gotta be a better way.
Something like this:
<panel id="image_overlay_panel">
<search id="loc_1s">
<query>index=wifi_data | lookup wap_lookup WapName as ap_name | stats count by Floor | stats list(count) as foo
</query>
<done>
<set token="loc_1">$result.foo[0]$</set>
<set token="loc_2">$result.foo[1]$</set>
<set token="loc_3">$result.foo[2]$</set>
</done>
</search>
<html>
<div class="map_display">
<div class="image"></div>
<div class="singleValue" id="loc_1">$loc_1$</div>
<div class="singleValue" id="loc_2">$loc_2$</div>
<div class="singleValue" id="loc_3">$loc_3$</div>
</div>
</html>
$result.foo comes back with a comma-sep list of values, but I can't easily pull them apart into the N separate values for the N <div> sections.
Any ideas?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
08-08-2018
07:50 AM
If you have definite number of tokens, then you could do it by
<done>
<eval token="loc_1">mvindex($result.foo$,0)</eval>
<eval token="loc_2">mvindex($result.foo$,1)</eval>
</done>
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
08-08-2018
07:50 AM
If you have definite number of tokens, then you could do it by
<done>
<eval token="loc_1">mvindex($result.foo$,0)</eval>
<eval token="loc_2">mvindex($result.foo$,1)</eval>
</done>
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jbp4444
Path Finder
08-08-2018
10:31 AM
AHHHH ... I didn't know you could do that inside the XML/eval!
That worked -- thanks for the tip!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
08-08-2018
05:25 PM
@jbp4444, Glad it worked 🙂 . Converted to answer. Please accept as answer to close the thread
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
renjith_nair
Legend
08-08-2018
06:52 AM
Does mvexpand foo help ?
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jbp4444
Path Finder
08-08-2018
07:11 AM
That will just return a different set of results ... still can't pull them apart in the xml/set-token code.
Get Updates on the Splunk Community!
The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...
The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...
Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25
Hello Splunkers,
Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...
Community Spotlight: A Splunk Expert's Journey
In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...
