Splunk Search

How to list values to fields based on userid selected in a drop-down form?

edroche3rd
Explorer

good morning all

So I have a table chart with a drop-down that selects a user and this works fine. When I select a user, it searches our kvstore and brings back records. The fields it brings back values for are "skills, levels, memid". The skills field has 27 or 28 values, levels field has 6 values and memid can be any amount.

After selecting a userid from the drop-down what, I am getting back is a table with column headers "Skills, Levels, Memid" with a record for each skill and level combo for that particular userid. So to put in perspective, 28 skills times 5 levels equals 140 records returned the max return should be 28, one level for each skill. Below is my current search definition. I have tried doing a dedup on skills that sort of works, but gives the same level value for each skill. So I get the 28 records like I am suppose to, but the level for each is "None", the first value in the levels field in the search.

Any help would be awesome!
Thanks
Ed

| inputlookup dojo_dev | search memid = $memid_token$ | eval skills = "netq bmc ehlth netdoc hpnnm splunk trident aternity ngenius sniffer airwave vidconf brocade rivrbd clrpass dns dhcp cisco ciscoworks bna asafwalls paltoaltofwalls xnet certadmin bluecat ldbalf5 webservx150 raisedflrserv" | eval levels = "None White Orange Blue Red Black" | makemv skills | makemv levels | mvexpand skills | mvexpand levels | fields skills, levels, memid
0 Karma
1 Solution

woodcock
Esteemed Legend

I am going just by your subject line; do this:

| inputlookup dojo_dev memid = $memid_token$ | stats values(*) AS *

View solution in original post

0 Karma

woodcock
Esteemed Legend

I am going just by your subject line; do this:

| inputlookup dojo_dev memid = $memid_token$ | stats values(*) AS *
0 Karma

edroche3rd
Explorer

using that template, here is what I did and got what I was looking for 🙂

| inputlookup dojo_dev | search memid = $memid_token$ | fields - memfn - memln - mgr - memid

Now one last twist, can I split the table up based on width of panel

0 Karma

woodcock
Esteemed Legend

You definitely do not need the | search (which I deleted).

If you are asking about a way to prevent wide tables from adding a horizontal scrollbar, I don't know of any way to "paginate" or otherwise prevent a scrollbar.

Don't forget to "Accept" the answer to close the question.

0 Karma

somesoni2
Revered Legend

What is the expected output? If you don't want "None" for levels, what is the criteria to assign levels to skills?

0 Karma

edroche3rd
Explorer

the levels are already assigned when the user is added to the kvstore. So all I need it to do is search for a userid and spit out the skills and the level for that user. Example:

memid = u123

skills levels memid (only here to compare)
brocade White U123
asafirewalls Blue U123
...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...