Splunk Search

dynamic valueSuffix tag

fsaporito
Explorer

Hello,

I have this checkbox in my dashboard:

<input type="multiselect" token="t_case" searchWhenChanged="true">
      <label>Cases</label>
      <search base="base">
        <query>| dedup Rule</query>
      </search>
      <delimiter> , </delimiter>
      <fieldForLabel>Rule</fieldForLabel>
      <fieldForValue>Rule</fieldForValue>
      <default>FUAA01,NML02,WML01,WML02</default>
      <valuePrefix>count(eval(Rule="</valuePrefix>
      <valueSuffix>")) AS $value$</valueSuffix>
    </input>

the problem is valueSuffix, it seems cannot be "dynamic" (i.e. the suffix is totally missing because it seems it cannot evaluate $value$ and it's totally lost).
this token is evaluated in a chart command and this should be the final output (with two selected values, for example):

chart count(eval(Rule="FUAA01")) AS FUAA101 , count(eval(Rule="NML02")) AS NML02 over date_month by CustomerID

Is there a way to achieve that, only with XML?

thanks,
Fausto

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

Dashboard Input:

<input type="multiselect" token="t_case" searchWhenChanged="true">
    <label>Cases</label>
    <fieldForLabel>Rule</fieldForLabel>
    <fieldForValue>case</fieldForValue>
    <search base="base">
    <query> 
| dedup Rule 
| mvcombine Rule 
| eval prefix="count(eval(Rule=\"" 
| eval sufix="\")) AS " 
| mvexpand Rule 
| eval case=prefix.Rule.sufix.Rule 
| table case Rule</query>
    </search>
    <delimiter> </delimiter>
    <default>"count(eval(Rule=""FUAA01"")) AS FUAA01","count(eval(Rule=""NML02"")) AS NML02","count(eval(Rule=""WML01"")) AS WML01","count(eval(Rule=""WML02"")) AS WML02"</default>
    </input>

Query:

 | chart $t_case$ over date_month by CustomerID

My sample XML:

<form>
  <label>dynamic token</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="t_case" searchWhenChanged="true">
      <label>Cases</label>
      <fieldForLabel>Rule</fieldForLabel>
      <fieldForValue>case</fieldForValue>
      <search>
        <query>| makeresults
| eval Rule=split("FUAA01,NML02,WML01,WML02",",")
| mvexpand Rule 
| table Rule
| mvcombine Rule
| eval prefix="count(eval(Rule=\""
| eval sufix="\")) AS "
| mvexpand Rule
| eval case=prefix.Rule.sufix.Rule
| table case Rule</query>
      </search>
      <delimiter> </delimiter>
      <default>"count(eval(Rule=""FUAA01"")) AS FUAA01"</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-1y@d"), relative_time(_time,"@d"))
| makecontinuous span=1d _time
| eval Rule=mvindex(split("FUAA01,NML02,WML01,WML02",","),(random() % 4))
| eval CustomerID="ID".(random() % 5 + 1)
| table _time CustomerID Rule
| eval date_month=strftime(_time,"%m")
| chart $t_case$ over date_month by CustomerID</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Hi, @fsaporito
I managed to do it.

View solution in original post

to4kawa
Ultra Champion

Dashboard Input:

<input type="multiselect" token="t_case" searchWhenChanged="true">
    <label>Cases</label>
    <fieldForLabel>Rule</fieldForLabel>
    <fieldForValue>case</fieldForValue>
    <search base="base">
    <query> 
| dedup Rule 
| mvcombine Rule 
| eval prefix="count(eval(Rule=\"" 
| eval sufix="\")) AS " 
| mvexpand Rule 
| eval case=prefix.Rule.sufix.Rule 
| table case Rule</query>
    </search>
    <delimiter> </delimiter>
    <default>"count(eval(Rule=""FUAA01"")) AS FUAA01","count(eval(Rule=""NML02"")) AS NML02","count(eval(Rule=""WML01"")) AS WML01","count(eval(Rule=""WML02"")) AS WML02"</default>
    </input>

Query:

 | chart $t_case$ over date_month by CustomerID

My sample XML:

<form>
  <label>dynamic token</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="t_case" searchWhenChanged="true">
      <label>Cases</label>
      <fieldForLabel>Rule</fieldForLabel>
      <fieldForValue>case</fieldForValue>
      <search>
        <query>| makeresults
| eval Rule=split("FUAA01,NML02,WML01,WML02",",")
| mvexpand Rule 
| table Rule
| mvcombine Rule
| eval prefix="count(eval(Rule=\""
| eval sufix="\")) AS "
| mvexpand Rule
| eval case=prefix.Rule.sufix.Rule
| table case Rule</query>
      </search>
      <delimiter> </delimiter>
      <default>"count(eval(Rule=""FUAA01"")) AS FUAA01"</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-1y@d"), relative_time(_time,"@d"))
| makecontinuous span=1d _time
| eval Rule=mvindex(split("FUAA01,NML02,WML01,WML02",","),(random() % 4))
| eval CustomerID="ID".(random() % 5 + 1)
| table _time CustomerID Rule
| eval date_month=strftime(_time,"%m")
| chart $t_case$ over date_month by CustomerID</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Hi, @fsaporito
I managed to do it.

fsaporito
Explorer

Very very nice solution indeed! Perfect!
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...