I am on Splunk 8.1 trying to create a dynamic dashboard. I am trying to create a multisearch query, the searches for which will be based on the checkboxes that the user clicks.
<input type="time" token="field1">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="userinput1">
<label>User Input 1</label>
</input>
<input type="text" token="userinput2">
<label>User Input 2</label>
</input>
<input type="checkbox" token="indexesSelected" searchWhenChanged="true">
<label>Indexes</label>
<choice value="[search index=index1 $userinput1$ $userinput2$]">Index 1</choice>
<choice value="[search index=index2 $userinput1$ $userinput2$]">Index 2</choice>
<default></default>
<initialValue></initialValue>
<delimiter> </delimiter>
<prefix>| multisearch [eval test1="test1"] [eval test2="test2"] </prefix>
</input>
The search part looks like this:
<search>
<query>$indexesSelected$
| table _time, index, field1, field2, field3, field4
| sort Time
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
This works as expected except that the final query looks like this:
| multisearch [eval test1="test1"] [eval test2="test2"]
[search index=index1 $userinput1$ $userinput2$]
[search index=index2 $userinput1$ $userinput2$]
How can I make these $userinput1$ and $userinput2$ be converted to their token value from the user inputs in the dashboard and not as literal strings.
I have tried to use <change> tags to use eval and set based on the <condition> that the user selects, but eval does not allow token value and replaces with literal strings only. Something like this:
<change>
<condition match="like($indexesSelected$,"%index1%")">
<eval token="finalQuery">replace($indexesSelected$,"index1", "[search index=index1 $userinput1$ $userinput2$]")</eval>
</condition>
<condition match="like($indexesSelected$,"%index2%")">
<eval token="finalQuery">replace($indexesSelected$,"index2", "[search index=index2 $userinput1$ $userinput2$]")</eval>
</condition>
</change>
Related
How to manually enter the location coordinates on the Itempost page in osclass?
<input id="d_coord_lat" type="" name="d_coord_lat" value="" />
<input id="d_coord_long" type="" name="d_coord_long" value="" />
I tried it
But it does not add data
If the data is there, it should appear somewhere value
Thank
i am trying to create a Splunk dashboard, where I want to set a value to a token based on the two dropdown values(service dropdown and environment dropdown)
<input type="dropdown" token="service" searchWhenChanged="true">
<label>service</label>
<choice value="capi">capi</choice>
<choice value="crapi">crapi</choice>
<choice value="oapi">oapi</choice>
<default>capi</default>
<initialValue>capi</initialValue>
</input>
<input type="dropdown" token="environment" searchWhenChanged="true">
<label>Environment</label>
<choice value="prod">prod</choice>
<choice value="ppe">ppe</choice>
<choice value="pte">pte</choice>
<choice value="dev">dev</choice>
<default>prod</default>
<initialValue>prod</initialValue>
</input>
above are the 2 dropdowns, now i want to set a value to token "endpoint" based on value selected in service and environment dropdown values.
i tried using condition match, but i am not getting it right
<condition match="$service$==capi AND $environment$==ppe">
<set token = endpoint>"/capi/ppe"</set>
</condition>
Try doing an eval in your search proper:
<search>
<query>... | eval endpoint="/$service$/$environment$" | ...
Or try doing an <eval>...</eval> on change from both dropdowns:
<input type="dropdown" token="service" searchWhenChanged="true">
<label>service</label>
<choice value="capi">capi</choice>
<choice value="crapi">crapi</choice>
<choice value="oapi">oapi</choice>
<default>capi</default>
<initialValue>capi</initialValue>
<change>
<eval token="endpoint">"/"+$service$+"/"+$environment$</eval>
</change>
</input>
<input type="dropdown" token="environment" searchWhenChanged="true">
<label>Environment</label>
<choice value="prod">prod</choice>
<choice value="ppe">ppe</choice>
<choice value="pte">pte</choice>
<choice value="dev">dev</choice>
<default>prod</default>
<initialValue>prod</initialValue>
<change>
<eval token="endpoint">"/"+$service$+"/"+$environment$</eval>
</change>
</input>
I have a xml data column. The XML data contains a form with different page headers. Each page has radio type values. I need to pick the value from one page and its values.
I need the value 'id' from Page topic='Outreach' under that, Question value="Type of Outreach", in that i need the id="1" value and also i need the id value from Question value="Reason for Assessment".
Below is the sample xml data.
<Test name="Assessment " header="" logoimg="" background="" icon="" firstPage="1" allow_abort="1" is_um="0" is_hidden="0" do_only="1" status="1" locale_id="0" version="74" category_id="150011" maxQuestionID="37" id="10234" force_start="0" user_name=" ggg bbb">
<PAGE topic="Outreach " progress="5" background="" headerid="" footerid="" flush_concepts="1" lastPage="false" id="1">
<BRANCH_CONDITION>
<NEXT_PAGE id="2" />
</BRANCH_CONDITION>
<QUESTION value="Type of Outreach " defaultvalue="" style="" tooltip="" read_only="0" usability="5" prefer_concept="0" type="radio" validation="0" id="1" pagename="Outreach ">
<OPTIONS>
<OPTION value="Outbound Telephone " id="1" url="" score="0" />
<OPTION value="Inbound Telephone" id="2" url="" score="0" />
<OPTION value="In Person" id="3" url="" score="0" />
</OPTIONS>
</QUESTION>
<QUESTION value="Reason for Assessment " defaultvalue="" style="" tooltip="" read_only="0" usability="5" prefer_concept="0" type="radio" validation="0" id="2" pagename="Outreach ">
<OPTIONS>
<OPTION value="New" id="1" url="" score="0" />
<OPTION value="Annual" id="2" url="" score="0" />
<OPTION value="Triggering Event " id="3" url="" score="0" />
<OPTION value="LOC Review" id="4" url="" score="0" />
</OPTIONS>
</QUESTION>
I tried the following sql.
SELECT TABLE.META_DATA.value('(/QUESTION//id/node())[1]','int') as outReach
,TABLE.META_DATA.value('(/QUESTION//id/node())[1]','int') as ReasonForAssessment
FROM Table
Below is my expected result
+----------+---------------------+
| Outreach | ReasonForAssessment |
+----------+---------------------+
| 1 | 2 |
Several issues:
QUESTION is not the root of the XML so you must use // or walk down tree from root: /Test/PAGE/QUESTION/.
Adjust XPath to search by attribute with # prefix and not node search as id is an attribute (not child node) of QUESTION.
Adjust node index, [#], to return the corresponding #id attribute value.
Adjusted SQL:
SELECT TABLE.META_DATA.value('(//QUESTION/#id)[1]','int') as outReach
, TABLE.META_DATA.value('(//QUESTION/#id)[2]','int') as ReasonForAssessment
FROM Table;
-- outReach ReasonForAssessment
-- 1 2
Alternatively use bracketed conditionals for columns:
SELECT TABLE.META_DATA.value('(/Test/PAGE/QUESTION[#value=''Type of Outreach '']/#id)[1]','int') as outReach
, TABLE.META_DATA.value('(/Test/PAGE/QUESTION[#value=''Reason for Assessment '']/#id)[1]','int') as ReasonForAssessment
FROM Table;
-- outReach ReasonForAssessment
-- 1 2
Is it possible add icon instead text in list view?
Example:
<field name="status" />
If status = phone display (icon="fa-phone) else status = fax display (icon="fa-fax).
Field display with string fax or phone.
You need to change icon name.
Try with this:
<field name="status" invisible='1'/>
<button name="status" icon="fa-check text-success" attrs="{'invisible': ['|',('status','=','phone')]}" />
<button name="status" icon="fa-times-circle text-danger" attrs="{'invisible': ['|',('status','=','fax')]}" />
Hi friends i have developed an application of PhotoAlbum, in show photo jsp the page shows all user information along with their uploaded image names. the output it displays on jsp is similar to the below format.
==========================================================================
| NAME | FatherName |AGE|ADDRESS | PhotoList |
==========================================================================
|nathjo r | FATHERNAME |12 | XYZ |[asasdd, asada, asada, aasasada] |
|SRT | ERNAME |12 | XYZ |[1212, 1212, 1212] |
|SRY | ERNAME |12 | XYZ |[bb, ccas, asdda, da, qwqda, qwqda, qwqda] |
==========================================================================
as you can see it is perfect, the last column[PhotoList] is a list of strings. so my question is i want to do iteration [put logical iterator tag] on the last column to do additional operation depending on the number of element present in the last column along with displaying image names. so what i thought is like this i know it is wrong any suggestion to do it like that.
<display:table id="data" name="sessionScope.UserForm.userList" requestURI="/userAction.do" pagesize="3" >
<display:column property="name" title="NAME" sortable="true" />
<display:column property="fatherName" title="User Name" sortable="true" />
<display:column property="age" title="AGE" sortable="true" />
<display:column property="address" title="ADDRESS" sortable="true" />
<logic:iterate property="photolist" id="photoId" indexId="index">
***here i want to display the image name***
</logic:iterate>
</display:table>
Thanks in Advance
Lets have iterate tag inside the <display:column> tag something like this
<display:table id="data" name="sessionScope.UserForm.userList" requestURI="/userAction.do" pagesize="3" >
<display:column property="name" title="NAME" sortable="true" />
<display:column property="fatherName" title="User Name" sortable="true" />
<display:column property="age" title="AGE" sortable="true" />
<display:column property="address" title="ADDRESS" sortable="true" />
<display:column title="Photo List">
<logic:iterate property="photolist" id="photoId" indexId="index">
<s:property />,
</logic:iterate>
</display:column>
</display:table>