Splunk Search

access row in xyseries

gerbert
Path Finder

Hello,

I have a table from a xyseries. Each row consists of different strings of colors. I would like to pick one row from the xyseries, save it in some sort of token and then use it later in an svg-file. The svg file is made up of three rectangles, which colors should depend on the chosen row of the xyseries.

For example the search I made looks like this:

 

index=something
|stats latest(vitamins) by fruit
|eval color = if(fruit=="$fruit_token$", "red", 0)
|fillnull value="green"
|xyseries fruit vitamins color

 


Which gives something like this, when i choose apple as a fruit:
                                                vitaminA                       vitaminB             vitaminC
apple                                    green                              red                        green
banana                                green                              green                   green

The idea is that I can search for a fruit I want (with an input-token), set the value in latest(vitamin) of that row to "red" and the rest to "green".

Is there a way for me to access the "apple-row" as a whole? I can access a single column of a row by addressing the column name, i.e:

 

|search fruit=$fruit_token$
|eval var="something"+vitaminB+"else"
|table var

 

 would give something like:
"somethingredelse"

Which then I can store in a variable. But I somehow want all the rest (all the "greens") also.
My end goal would be to use a svg-file, that looks something like this:

 

<row>
     <panel>
          <viz type="svg.svg">   
          <search>
               |makeresults
               |eval svg_viz = ".... 
               &lt;rect id=01 fill=\"$vitaminA$\"$ &gt;
               &lt;rect id=02 fill=\"$vitaminB$\"$ &gt; 
               &lt;rect id=03 fill=\"$vitaminC$\"$ &gt; 
               ..."
               [...] 
          </search>
          </viz>  
     </panel>
</row>

 

 

So in our example, if apple is my chosen fruit I would like to have my first rectangle to have the color "green", the 2nd the color "red" and the third one the color "green". In the end I would use hex code instead of "red" and "green".

I hope this isn't a too narrow subject. I basically need some sort of access to the xyseries table. Maybe instead of using tokens I could also use my first search inside of the svg-file-query, but I couldn't get that to work either.

I could use some help 😃

Cheers
gerbert

Labels (1)
Tags (3)
0 Karma
1 Solution

gerbert
Path Finder

Ok, just in case anyone is stumbling onto this thread and is wondering how to solve it, here it is.
You have to end the "svg-string" and insert your token inbetween and then add the whole string back together with a plus sign. It looks something like this then:

 

<row>
     <panel>
          <viz type="svg.svg">   
          <search>
               |makeresults
               |eval svg_viz = ".... 
               &lt;rect id=01 fill=\" "+vitaminA+" \"$ &gt;
               &lt;rect id=02 fill=\" "+vitaminB+" \"$ &gt; 
               &lt;rect id=03 fill=\" "+vitaminC+" \"$ &gt; 
               ..."
               [...] 
          </search>
          </viz>  
     </panel>
</row>

 

 
Cheers

gerbert

View solution in original post

0 Karma

gerbert
Path Finder

Ok, just in case anyone is stumbling onto this thread and is wondering how to solve it, here it is.
You have to end the "svg-string" and insert your token inbetween and then add the whole string back together with a plus sign. It looks something like this then:

 

<row>
     <panel>
          <viz type="svg.svg">   
          <search>
               |makeresults
               |eval svg_viz = ".... 
               &lt;rect id=01 fill=\" "+vitaminA+" \"$ &gt;
               &lt;rect id=02 fill=\" "+vitaminB+" \"$ &gt; 
               &lt;rect id=03 fill=\" "+vitaminC+" \"$ &gt; 
               ..."
               [...] 
          </search>
          </viz>  
     </panel>
</row>

 

 
Cheers

gerbert

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could use transpose to convert the row to a column

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...