Dashboards & Visualizations

Simple XML - how to handle multiple returned values from search?

Path Finder

I'm trying to send back a table of values to be displayed in an XML dashboard ... I can do it with N separate searches, each returning one value, but there's gotta be a better way.

Something like this:

  <panel id="image_overlay_panel">
      <search id="loc_1s">
          <query>index=wifi_data | lookup wap_lookup WapName as ap_name | stats count by Floor | stats list(count) as foo
          </query>
          <done>
            <set token="loc_1">$result.foo[0]$</set>
            <set token="loc_2">$result.foo[1]$</set>
            <set token="loc_3">$result.foo[2]$</set>
          </done>
      </search>
      <html>
          <div class="map_display">
              <div class="image"></div>
              <div class="singleValue" id="loc_1">$loc_1$</div>
              <div class="singleValue" id="loc_2">$loc_2$</div>
              <div class="singleValue" id="loc_3">$loc_3$</div>
          </div>
      </html>

$result.foo comes back with a comma-sep list of values, but I can't easily pull them apart into the N separate values for the N <div> sections.

Any ideas?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

If you have definite number of tokens, then you could do it by

          <done>
            <eval token="loc_1">mvindex($result.foo$,0)</eval>
            <eval token="loc_2">mvindex($result.foo$,1)</eval>
          </done>

View solution in original post

0 Karma

Path Finder

AHHHH ... I didn't know you could do that inside the XML/eval!

That worked -- thanks for the tip!

0 Karma

SplunkTrust
SplunkTrust

@jbp4444, Glad it worked 🙂 . Converted to answer. Please accept as answer to close the thread

0 Karma

SplunkTrust
SplunkTrust

Does mvexpand foo help ?

0 Karma

Path Finder

That will just return a different set of results ... still can't pull them apart in the xml/set-token code.

0 Karma