Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is it possible to set a token with the value of the nth row of a result set?

$
0
0
Hello All, Using this run anywhere for reference: | makeresults | eval fruit = "Apple", amount=54 | append [ | makeresults | eval fruit = "Pear", amount=2 ] | append [ | makeresults | eval fruit = "Cantaloupe", amount=5000 ] | append [ | makeresults | eval fruit = "Strawberry", amount=1 ] | sort -amount | table fruit amount My objective is to set three tokens with the names of the three fruits with the highest counts (in this case Canteloupe, Apple, Pear) three separate values after the above search completes in a dashboard. I am using the `` tag to invoke the procedure, but I am having difficulty figuring out how to get it to work. If I set drilldown as follows I can click the value I want:$row.fruit$ What I'd like to do is take it one step further and have the first three rows get associated to tokens automatically. Something along the lines of:$row[0].fruit$$row[1].fruit$$row[2].fruit$ Is this possible? Thanks! Andrew

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>