Splunk Search

How to add a static value to a table with one column?

brajaram
Communicator

I'm trying to add a single value to a table I use to dynamically populate a selector in a dashboard. The search I use to populate the dropdown is:

index=initial search|dedup pageURL| table pageURL

I want to add to the end of the search something that can be a * value. The reason for this is that in my dashboards built off of the input, I use $pageURL$ to allow viewers to select the specific page they wish to see stats for. However, I want a specific value where I set pageURL=*so that viewers can see what all the pages look like. I tried doing the following as the search to populate the dropdown:

index=initial search|dedup pageURL| table pageURL | append [|table pageURL | eval pageURL="*"]

But that didn't add a value of * to the end of the table. Is there a way I can do this?

Tags (2)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

View solution in original post

maciep
Champion

Also, if I understand what you're asking correctly, I typically add a manual entry to the input as well. You can call that one "All" and give it a value of *. So then your users would have an All option in the dropdown along with each pageURL from your dynamic search.

That's might be a bit easier than trying to append it to your dynamic search.

brajaram
Communicator

I didn't even think about adding a static value, thanks! That does seem a lot more efficient.

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults!

livehybrid
SplunkTrust
SplunkTrust

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...