Splunk Search

How to add a static value to a table with one column?

brajaram
Communicator

I'm trying to add a single value to a table I use to dynamically populate a selector in a dashboard. The search I use to populate the dropdown is:

index=initial search|dedup pageURL| table pageURL

I want to add to the end of the search something that can be a * value. The reason for this is that in my dashboards built off of the input, I use $pageURL$ to allow viewers to select the specific page they wish to see stats for. However, I want a specific value where I set pageURL=*so that viewers can see what all the pages look like. I tried doing the following as the search to populate the dropdown:

index=initial search|dedup pageURL| table pageURL | append [|table pageURL | eval pageURL="*"]

But that didn't add a value of * to the end of the table. Is there a way I can do this?

Tags (2)
0 Karma
1 Solution

livehybrid
Builder

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

View solution in original post

maciep
Champion

Also, if I understand what you're asking correctly, I typically add a manual entry to the input as well. You can call that one "All" and give it a value of *. So then your users would have an All option in the dropdown along with each pageURL from your dynamic search.

That's might be a bit easier than trying to append it to your dynamic search.

brajaram
Communicator

I didn't even think about adding a static value, thanks! That does seem a lot more efficient.

0 Karma

livehybrid
Builder

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults!

livehybrid
Builder

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...