- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Simple XML - how to handle multiple returned v...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to send back a table of values to be displayed in an XML dashboard ... I can do it with N separate searches, each returning one value, but there's gotta be a better way.
Something like this:
<panel id="image_overlay_panel">
<search id="loc_1s">
<query>index=wifi_data | lookup wap_lookup WapName as ap_name | stats count by Floor | stats list(count) as foo
</query>
<done>
<set token="loc_1">$result.foo[0]$</set>
<set token="loc_2">$result.foo[1]$</set>
<set token="loc_3">$result.foo[2]$</set>
</done>
</search>
<html>
<div class="map_display">
<div class="image"></div>
<div class="singleValue" id="loc_1">$loc_1$</div>
<div class="singleValue" id="loc_2">$loc_2$</div>
<div class="singleValue" id="loc_3">$loc_3$</div>
</div>
</html>
$result.foo comes back with a comma-sep list of values, but I can't easily pull them apart into the N separate values for the N <div> sections.
Any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you have definite number of tokens, then you could do it by
<done>
<eval token="loc_1">mvindex($result.foo$,0)</eval>
<eval token="loc_2">mvindex($result.foo$,1)</eval>
</done>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you have definite number of tokens, then you could do it by
<done>
<eval token="loc_1">mvindex($result.foo$,0)</eval>
<eval token="loc_2">mvindex($result.foo$,1)</eval>
</done>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
AHHHH ... I didn't know you could do that inside the XML/eval!
That worked -- thanks for the tip!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jbp4444, Glad it worked 🙂 . Converted to answer. Please accept as answer to close the thread
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does mvexpand foo help ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That will just return a different set of results ... still can't pull them apart in the xml/set-token code.
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
