I would like to know if there is a simple way, via Splunk XML, to create a "for cycle" like routine, to generate panels or rows from a simple SPL search.
A simple example,
my_hosts.csvwith a list of hosts (host1 host2 host3)
I would like to automatically generate those panels, from a simple
with one single for cycle way, something like this:
for myhost in "| inputlookup my_hosts.csv"; do <---------------
title $myhost$ /title
search ... host=$myhost$ "critical" | stats count
Is there a way?
@verbal_666 if you want to have dynamic single values for each host in the lookup, please try the Trellis Layout feature and confirm. Following is the Splunk Documentation
You will find several examples on Splunk Answers if you search for Trellis Single Value.
I surely yet tried the trellis function. I'm not really sure i can apply, inside the trellis, a real layout format, like creating a real PANEL or ROW, since trellis create a single PANEL and formats it as a single search (with page layout with scrolling buttons "< >") splitting each search by a field in a single panel.
I really wanted to create a for cycle in XML, i think it's necessary to convert in html/js the dashboard and work inside it, as a real developer.
@verbal_666 the one panel per host is table or any chart? Can you elaborate? If they are chart you can definitely try Trellis layout!