Splunk Search

How to iterate through a result set inside the dashboard?

DaDave
Engager

Hello,

inside my dashboard I have a multi select input. The options in this field are determined by a query, which is working perfectly fine. I would like to hide or display certain fields if a specific value is inside this result set (I do know the column name but not the position). Please note that the fields should get displayed before anything is selected in the multi value field.

I already have a working solution in case the value I am looking for is returned at the first position in my query using this (for the sake of readability simplified) code:

 

 

 

<input type="multiselect">
      <label>Please Select</label>
      <search>
        <query>"a query returing a table with two column and multiple rows"
</query>
      <done>
	       <set token="QUERY_result">$result.column$</set>
	       <eval token="QUERY_check">case($QUERY_result$=="theValueIamLookingFor","true")</eval>
	    </done>
	   </search>
    </input>

<input type="radio" token="RadioTest" depends="$QUERY_check$">
</input>

 

 

 

If the value is returned on another position the solution is not working anymore. Is there a way to loop through the result, somewhat like shown in the below code snipped. Since it is planed to show or hide multiple views based on different values.

 

 

for each row in result.column do
   if row == "searchString1" do
      set token1
   done
   if row == "searchString2" do
      set token2
   done
   [...]
done

 

 

 

 If it is somehow possible without alter the query it would be perfect since it is used on other places in the dashboard and it would get messy to change it.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could include a third column which has all the values in as a multi-value field, then you can check for the presence of the values you are looking for in that field.

Without more detail about how the query is used elsewhere in the dashboard, it is difficult to say whether this can be done without affecting other parts of the dashboard, however, you could consider using a base query which is extended to have the multi-value field for the multi-select and used as is elsewhere in the dashboard.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...