Splunk Search

How To Use The Result Of Query ( Single Panel ) In A Radio Button Text?

vtsguerrero
Contributor

Hello guys!

I needed to use a single panel to show three status, green, yellow and red.
But the problem is, a row with three single panels got too big for the dashboard.
So I was asked to display this stats count based inside the same input (radio) that filters the search:
For example

[label]Status:[/label]

[input radio button]Green: ( Total Count 2 )[/input radio button]
[input radio button]Yellow: ( Total Count 8 )[/input radio button]
[input radio button]Red: ( Total Count 1 )[/input radio button]

Can I use the result of a query inside the text of an input or label of this input?
Thanks in advance!

0 Karma

jeffland
SplunkTrust
SplunkTrust

I don't know if you can use the result of a search directly (especially since the search needs to finish befor that result can be used), but you can certainly change the text of your radio button with jquery once the search is done. I'm thinking of something like

var search = splunkjs.mvc.Components.getInstance("count_search"); // get your search here
var myResults = search.data("results"); // get those results from the search
var resultArray = []; // prepare an array for the rows of results
var radios = $(".splunk-radiogroup-choices").find("label"); // this gets you all labels that are descendants of the class splunk-radiogroup-choices
var labelArray = [ "Green ", "Yellow ", "Red "]; // this can be used to label your buttons

myResults.on("data", function() {
    resultArray = myResults.data().rows; // fetch rows
    for (var i = 0; i < 3; i++) {
        radios[i].textContent = labelArray[i] + " (Total count: " + resultArray[i][1] +")"; // replace the text of your buttons
    }
});

This works assuming you have only one radiobutton group, otherwise you'll have to specify your buttons differently. Also this assumes your results are always returned in the order green - yellow - red, but it could also make sense to use text based on the result from your search here (i.e. if your search returns a column with color names in it, you could use that instead of labelArray[i], such as resultArray[i][0]). You should probably make your initial button labels look something like "Green (Total count: ...)" or something like that to indicate a search is running.

Hope this works for you.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...