Dashboards & Visualizations

Sum with multivalue token

Shaft
Explorer

How to sum the values of a multivalue token in Simple XML?

Let's say you have a mv token named test1 with values of: 1,2,3

How to achieve something like:
<eval token="test2">sum($test1$)</eval>

Thanks!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

One way might be to use relative_time which will interpret strings

<eval token="test2">if(mvcount($test1$)>1,relative_time(0,"@s+".mvjoin($test1$,"s+")."s"),$test1$)</eval>

Be aware that is $test1$ is from something like a multiselect dropdown, you may need to use $form.test1$ to get the multivalue version of the field rather than the concatenated version.

View solution in original post

0 Karma

Shaft
Explorer

What a trick! Well done....

ITWhisperer
SplunkTrust
SplunkTrust

One way might be to use relative_time which will interpret strings

<eval token="test2">if(mvcount($test1$)>1,relative_time(0,"@s+".mvjoin($test1$,"s+")."s"),$test1$)</eval>

Be aware that is $test1$ is from something like a multiselect dropdown, you may need to use $form.test1$ to get the multivalue version of the field rather than the concatenated version.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...