Splunk Search

How to iterate through a result set inside the dashboard?

DaDave
Engager

Hello,

inside my dashboard I have a multi select input. The options in this field are determined by a query, which is working perfectly fine. I would like to hide or display certain fields if a specific value is inside this result set (I do know the column name but not the position). Please note that the fields should get displayed before anything is selected in the multi value field.

I already have a working solution in case the value I am looking for is returned at the first position in my query using this (for the sake of readability simplified) code:

 

 

 

<input type="multiselect">
      <label>Please Select</label>
      <search>
        <query>"a query returing a table with two column and multiple rows"
</query>
      <done>
	       <set token="QUERY_result">$result.column$</set>
	       <eval token="QUERY_check">case($QUERY_result$=="theValueIamLookingFor","true")</eval>
	    </done>
	   </search>
    </input>

<input type="radio" token="RadioTest" depends="$QUERY_check$">
</input>

 

 

 

If the value is returned on another position the solution is not working anymore. Is there a way to loop through the result, somewhat like shown in the below code snipped. Since it is planed to show or hide multiple views based on different values.

 

 

for each row in result.column do
   if row == "searchString1" do
      set token1
   done
   if row == "searchString2" do
      set token2
   done
   [...]
done

 

 

 

 If it is somehow possible without alter the query it would be perfect since it is used on other places in the dashboard and it would get messy to change it.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could include a third column which has all the values in as a multi-value field, then you can check for the presence of the values you are looking for in that field.

Without more detail about how the query is used elsewhere in the dashboard, it is difficult to say whether this can be done without affecting other parts of the dashboard, however, you could consider using a base query which is extended to have the multi-value field for the multi-select and used as is elsewhere in the dashboard.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...