Splunk Search

How to assign multivalued field to a variable?

Mohsin123
Path Finder

Hi,

I'm trying to assign the multivalue field ApixRes and RestRes to a new variable result . But , it isnt working as expected .
PFB my code :
Intention : if the user selects component as APIX from the drop down then the result is shown as count by service else it will show count as component :
Kindly help:

index=<> sourcetype=<> component="APIX"   logpoint=response-out status-code =4* OR status-code =5* 
| rename status-code as statuscode 
| stats count as ApixC by service,statuscode 
| appendcols 
    [| search index=<>  sourcetype<>  NOT component="APIX" logpoint=response-out status-code =4* OR status-code =5* 
    | rename status-code as statuscode 
    | stats count as CompRest by component,statuscode] 
| eval ApixCount=mvappend(ApixC,service) 
| eval RestCount=mvappend(CompRest,component) 
| mvcombine ApixCount 
| mvcombine RestCount 
| eval ApixRes=mvappend(ApixCount,statuscode) 
| eval RestRes=mvappend(RestCount,statuscode) 
| eval result=if($component$="APIX",ApixRes,RestRes)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @shraddhamuduli,

Try this run anywhere example. If it works fine, you need to replace search and "sourcetype" to service. This should be easier compared to assign all fields to a variable.

<form>
  <label>Shraddha</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_from_dropdown">
      <label>Sourcetype/Component</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype|append [|stats count|eval sourcetype="APIX"]|fields - count|dedup sourcetype</query>
        <earliest>-5m@m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$I_am_always_a_hidden_panel$">
      <table>
        <search>
          <query>|stats count|eval my_choice="$tok_from_dropdown$"|eval s_or_c=if("$tok_from_dropdown$"=="APIX","sourcetype","component")|fields s_or_c</query>
          <done>
            <set token="service_or_component">$result.s_or_c$</set>
          </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>Selection is $service_or_component$</title>
      <table>
        <search>
          <query>index=_*|stats count by $service_or_component$</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @shraddhamuduli,

Try this run anywhere example. If it works fine, you need to replace search and "sourcetype" to service. This should be easier compared to assign all fields to a variable.

<form>
  <label>Shraddha</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_from_dropdown">
      <label>Sourcetype/Component</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype|append [|stats count|eval sourcetype="APIX"]|fields - count|dedup sourcetype</query>
        <earliest>-5m@m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$I_am_always_a_hidden_panel$">
      <table>
        <search>
          <query>|stats count|eval my_choice="$tok_from_dropdown$"|eval s_or_c=if("$tok_from_dropdown$"=="APIX","sourcetype","component")|fields s_or_c</query>
          <done>
            <set token="service_or_component">$result.s_or_c$</set>
          </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>Selection is $service_or_component$</title>
      <table>
        <search>
          <query>index=_*|stats count by $service_or_component$</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

FrankVl
Ultra Champion

Have you checked whether the first part of your search (the search | appendcols [ subsearch] part) even gives sensible results? I can hardly imagine that construct works?

Also I can't make much sense of what your are trying to achieve with those mvappend and mvcombine actions.

If you want to choose between counting by service instead of by component, why not simply add an input for just that and put a token in the by clause of the stats command?

0 Karma

jplumsdaine22
Influencer

What part is not working? Do ApixRes and RestRes show the correct values? Assuimng they do..

if($component$="APIX")... will probably evaluate to false every time, if $component$ is not a quoted string. For example, if you are just passing the value APIX, then you will end up with: | eval result=if(APIX="APIX", ...) . Unless you have a field called APIX that also has the value "APIX", then it will evaluate false. Try quoting the token like so $component|s$ . That will make the eval statement | eval result=if("APIX"="APIX", ...) which will eval to true.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...