Splunk Search

How to iterate through a result set inside the dashboard?

DaDave
Engager

Hello,

inside my dashboard I have a multi select input. The options in this field are determined by a query, which is working perfectly fine. I would like to hide or display certain fields if a specific value is inside this result set (I do know the column name but not the position). Please note that the fields should get displayed before anything is selected in the multi value field.

I already have a working solution in case the value I am looking for is returned at the first position in my query using this (for the sake of readability simplified) code:

 

 

 

<input type="multiselect">
      <label>Please Select</label>
      <search>
        <query>"a query returing a table with two column and multiple rows"
</query>
      <done>
	       <set token="QUERY_result">$result.column$</set>
	       <eval token="QUERY_check">case($QUERY_result$=="theValueIamLookingFor","true")</eval>
	    </done>
	   </search>
    </input>

<input type="radio" token="RadioTest" depends="$QUERY_check$">
</input>

 

 

 

If the value is returned on another position the solution is not working anymore. Is there a way to loop through the result, somewhat like shown in the below code snipped. Since it is planed to show or hide multiple views based on different values.

 

 

for each row in result.column do
   if row == "searchString1" do
      set token1
   done
   if row == "searchString2" do
      set token2
   done
   [...]
done

 

 

 

 If it is somehow possible without alter the query it would be perfect since it is used on other places in the dashboard and it would get messy to change it.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could include a third column which has all the values in as a multi-value field, then you can check for the presence of the values you are looking for in that field.

Without more detail about how the query is used elsewhere in the dashboard, it is difficult to say whether this can be done without affecting other parts of the dashboard, however, you could consider using a base query which is extended to have the multi-value field for the multi-select and used as is elsewhere in the dashboard.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...