Splunk Search

How to add a static value to a table with one column?

brajaram
Communicator

I'm trying to add a single value to a table I use to dynamically populate a selector in a dashboard. The search I use to populate the dropdown is:

index=initial search|dedup pageURL| table pageURL

I want to add to the end of the search something that can be a * value. The reason for this is that in my dashboards built off of the input, I use $pageURL$ to allow viewers to select the specific page they wish to see stats for. However, I want a specific value where I set pageURL=*so that viewers can see what all the pages look like. I tried doing the following as the search to populate the dropdown:

index=initial search|dedup pageURL| table pageURL | append [|table pageURL | eval pageURL="*"]

But that didn't add a value of * to the end of the table. Is there a way I can do this?

Tags (2)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

View solution in original post

maciep
Champion

Also, if I understand what you're asking correctly, I typically add a manual entry to the input as well. You can call that one "All" and give it a value of *. So then your users would have an All option in the dropdown along with each pageURL from your dynamic search.

That's might be a bit easier than trying to append it to your dynamic search.

brajaram
Communicator

I didn't even think about adding a static value, thanks! That does seem a lot more efficient.

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults!

livehybrid
SplunkTrust
SplunkTrust

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

Get Updates on the Splunk Community!

Blueprints for High-Maturity Operations: Splunk Lantern Articles on SOAR, ES 8.4, ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...