About maxsteel

maxsteel · ‎10-12-2022

So table "works" but it was too much to keep adding this logic as I have a few columns, and I didn't want to have to keep editing them everywhere as I add/remove them. In the end, I fixed it differently (going to share how for the next person). Instead of using a csv (that, once again, gets read in will alphabetize the columns (booooo!)) I leveraged a report! It's probably a better way anyway. Once the report was scheduled, I leverage it using loadjob savedseach="user:app:reportname" This preserves column order!!

maxsteel · ‎10-11-2022

I was hoping to not have to create a table for each, hence the original question. That being said, if splunk likes to alphabetize outputlookup tables, then I guess I have to use a table and specify order each time.. yuk..

maxsteel · ‎10-07-2022

I leveraged stats to create the output in a specific order, not table. It appears that the outputlookup is rearranging my reusable csv alphabetically and then when I call it later it's showing this new alphabetical order. I'd rather it be in the same order as my stats so that I don't have to reorder every time I call the csv. (you are right that splunk doesn't care about order, but I do 🙂 )

maxsteel · ‎10-07-2022

I have a search that gathers a bunch of data from various sources and appends to 1 big stats that I have reporting in a customized column order. After I weed out some things I don't like, it looks perfect in search, so I appended a: | outputlookup file.csv to the very bottom so it'd write to a reusable csv. When I look at the dataset/csv it is rearranging my columns into an alphabetical order (caps first). Is there any way to keep my order in the csv so when I reference it later in an inputlookup I don't need to manually reorder it everytime?

maxsteel · ‎10-06-2022

To help others, I figured it out, the false result to have text and a token looks like: "AnimalTypes=".$click.value$ Notice the "s around the text and the . (dot) between the token.

maxsteel · ‎10-06-2022

@ITWhisperer I have a very similar thing going on, I can get the eval in the drilldown to work when I have a static value, however, it does not like when I have a variable in the 'false' in this example it would be the "AnimalTypes=$click.name2|s$" part. It is not substituting $click.value$ in my case (you have $click.name2|s$) with the value, it is sending the $click. Value$ parameter to the search.. thoughts?

maxsteel · ‎09-22-2022

oh boy, I should have caught that too.. d'oh! Thanks for your help, this now appears to work as expected. I would have preferred to have been able to keep the blanks in the table I created as it was sourced from 4 different datasources, and the blanks were much easier to see when there were issues to be 'spotted'. But alas, like all data, nulls and spaces are our worst enemies, so massaging to things like N/A are needed.... too bad "*" didn't just work for ALL and ANYTHING 🙂

maxsteel · ‎09-22-2022

(no worries, I appreciate the help) I tried this but didn't really like it: Here's the high level of what I tried: | stats ... | eval hw_stat_column=if(len(hw_stat_column> 2), hw_stat_column, null()) | fillnull value="N/A" hw_stat_column | search hw_stat_column=$HWStat$ got this: Error in 'EvalCommand': The arguments to the 'len' function are invalid.

maxsteel · ‎09-22-2022

in my OP I mentioned: (I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank). and wasn't displaying those..

maxsteel · ‎09-22-2022

I am trying to create a dashboard that has a dropdown input eg: <input type="dropdown" token="HWStat" searchWhenChanged="true"> <label>HW Status</label> <choice value="*">All</choice> <choice value="Installed">Installed</choice> <default>*</default> <initialValue>*</initialValue> </input> This was the easier part. Now when I go to use the token $HWStat$ it's just fine for passing the "Installed" option to the search. However, the asterisk "*" option for all when passed only displays results with values. I know there are a lot of "null" values in there as well that I would like the output to display. Also there appears to be some with "blanks" as well. (I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank). basic search I was testing: ending with: | stats ... | search hw_stat_column=$HWStat$ What is the better option to pass other than "*" to capture everything? I've scoured the internet, and this is not an easy thing to search for. Thanks in advance!

Posts	10
Solutions	1
Karma Given	2
Karma Received	2
Member Since	‎09-22-2022

Online Status	Offline
Date Last Visited	‎10-12-2022 04:39 PM

Outputlookup creating csv with columns that are al...

How to make dropdown select filter "need all to in...

Re: Outputlookup creating csv with columns that ar...

Re: Outputlookup creating csv with columns that ar...

Re: Outputlookup creating csv with columns that ar...

Outputlookup creating csv with columns that are al...

Re: Splunk Dashboard drilldown - replace "NULL" wi...

Re: Splunk Dashboard drilldown - replace "NULL" wi...

Re: Dropdown to be able to select filter, need all...

Re: Dropdown to be able to select filter, need all...

Re: Dropdown to be able to select filter, need all...

How to make dropdown select filter "need all to in...