Splunk Search

How to assign multivalued field to a variable?

Mohsin123
Path Finder

Hi,

I'm trying to assign the multivalue field ApixRes and RestRes to a new variable result . But , it isnt working as expected .
PFB my code :
Intention : if the user selects component as APIX from the drop down then the result is shown as count by service else it will show count as component :
Kindly help:

index=<> sourcetype=<> component="APIX"   logpoint=response-out status-code =4* OR status-code =5* 
| rename status-code as statuscode 
| stats count as ApixC by service,statuscode 
| appendcols 
    [| search index=<>  sourcetype<>  NOT component="APIX" logpoint=response-out status-code =4* OR status-code =5* 
    | rename status-code as statuscode 
    | stats count as CompRest by component,statuscode] 
| eval ApixCount=mvappend(ApixC,service) 
| eval RestCount=mvappend(CompRest,component) 
| mvcombine ApixCount 
| mvcombine RestCount 
| eval ApixRes=mvappend(ApixCount,statuscode) 
| eval RestRes=mvappend(RestCount,statuscode) 
| eval result=if($component$="APIX",ApixRes,RestRes)
0 Karma
1 Solution

renjith_nair
Legend

Hi @shraddhamuduli,

Try this run anywhere example. If it works fine, you need to replace search and "sourcetype" to service. This should be easier compared to assign all fields to a variable.

<form>
  <label>Shraddha</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_from_dropdown">
      <label>Sourcetype/Component</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype|append [|stats count|eval sourcetype="APIX"]|fields - count|dedup sourcetype</query>
        <earliest>-5m@m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$I_am_always_a_hidden_panel$">
      <table>
        <search>
          <query>|stats count|eval my_choice="$tok_from_dropdown$"|eval s_or_c=if("$tok_from_dropdown$"=="APIX","sourcetype","component")|fields s_or_c</query>
          <done>
            <set token="service_or_component">$result.s_or_c$</set>
          </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>Selection is $service_or_component$</title>
      <table>
        <search>
          <query>index=_*|stats count by $service_or_component$</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Hi @shraddhamuduli,

Try this run anywhere example. If it works fine, you need to replace search and "sourcetype" to service. This should be easier compared to assign all fields to a variable.

<form>
  <label>Shraddha</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_from_dropdown">
      <label>Sourcetype/Component</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype|append [|stats count|eval sourcetype="APIX"]|fields - count|dedup sourcetype</query>
        <earliest>-5m@m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$I_am_always_a_hidden_panel$">
      <table>
        <search>
          <query>|stats count|eval my_choice="$tok_from_dropdown$"|eval s_or_c=if("$tok_from_dropdown$"=="APIX","sourcetype","component")|fields s_or_c</query>
          <done>
            <set token="service_or_component">$result.s_or_c$</set>
          </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>Selection is $service_or_component$</title>
      <table>
        <search>
          <query>index=_*|stats count by $service_or_component$</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

FrankVl
Ultra Champion

Have you checked whether the first part of your search (the search | appendcols [ subsearch] part) even gives sensible results? I can hardly imagine that construct works?

Also I can't make much sense of what your are trying to achieve with those mvappend and mvcombine actions.

If you want to choose between counting by service instead of by component, why not simply add an input for just that and put a token in the by clause of the stats command?

0 Karma

jplumsdaine22
Influencer

What part is not working? Do ApixRes and RestRes show the correct values? Assuimng they do..

if($component$="APIX")... will probably evaluate to false every time, if $component$ is not a quoted string. For example, if you are just passing the value APIX, then you will end up with: | eval result=if(APIX="APIX", ...) . Unless you have a field called APIX that also has the value "APIX", then it will evaluate false. Try quoting the token like so $component|s$ . That will make the eval statement | eval result=if("APIX"="APIX", ...) which will eval to true.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...