I am using a variable called category that is defined as a custom variable using a key:value pair. The reason for this is that I wanted to put a clean name to the actual value. My initial variable definition was
In the SQL statement, I am referencing the variable using
sum(${category:text}
However, when doing so only the key portion of the variable definition gets used, which breaks the SQL query. In order to adjust I had to redefine by variable only using the value portion of the previously defined variable
rules_triggered, network_firewall, bot
Is there a way to continue using the key:value pair sequence and reference it using the ${category:text} syntax and be able to retrieve the associated value instead of the key?
Hi. I have seen reference to this syntax before but I am a little confused. In my SQL statement within the panel I am using
sum(${category:text}
If I change the variable to allow Multi-value and then update the SQL to
sum(${category:value}
The resulting interpolation is
sum({unique_hits,rules_triggered})
The reason for using the :text syntax was to ensure the field separator would be a + sign. I do not understand your suggestion to use both :value and :text … how does that syntax look?
I don’t believe that key/value variable was designated for multi value.
Use additional “help” dashboard variable, where you clean string {unique_hits,rules_triggered} with SQL, e.g. (not real full SQL)
SELECT REPLACE(${category:value}, '{' ,'')
and use that cleaned SQL string in the query, so valid SQL will be generated at the end.