topic Re: Multiselect input to hide/show multiple panels in Splunk Enterprise

How to achieve multiselect input to hide/show multiple panels?

mnj1809 — Mon, 17 Apr 2023 21:16:10 GMT

Hello,

Panels are not showing/hiding based on the selection of the multiselect input.

<form>
<label>Multiselect input to hide/show multiple panels</label>
<search>
<query>
| makeresults
| fields - _time
| eval data="$service_tok$"
| eval condition=case(match(data,"\*"),"show_all",match(data,"Windows") AND match(data,"NIX") AND match(data,"VMWare"),"show_all",match(data,"Windows"),"Windows",match(data,"NIX"),"NIX",match(data,"VMWare"),"VMWare")
| eval show_all=case(condition="show_all","true")
| eval show_windows=case(condition="Windows" OR condition="show_all","true")
| eval show_nix=case(condition="NIX" OR condition="show_all","true")
| eval show_vmware=case(condition="VMWare" OR condition="show_all","true")
</query>
<done>
<condition match="$job.resultCount$!=0">
<eval token="tokShowAll">case(isnotnull($result.show_all$),$result.show_all$)</eval>
<eval token="tokShowWindows">case(isnotnull($result.show_windows$),$result.show_windows$)</eval>
<eval token="tokShowNIX">case(isnotnull($result.show_nix$),$result.show_nix$)</eval>
<eval token="tokShowVMWare">case(isnotnull($result.show_vmware$),$result.show_vmware$)</eval>
</condition>
<condition>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="service_tok" searchWhenChanged="true">
<label>Select a Service</label>
<choice value="*">All</choice>
<choice value="Windows">Windows</choice>
<choice value="NIX">NIX</choice>
<choice value="VMWare">VMWare</choice>
<change>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</change>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<title></title>
</panel>
</row>
<row depends="$tokShowWindows$">
<panel>
<table>
<title>Windows Request Count</title>
<search>
<query>host=abcd source="/access.log*" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowNIX$">
<panel>
<table>
<title>NIX Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowVMWare$">
<panel>
<table>
<title>VMWare Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>

@ITWhisperer

Re: Multiselect input to hide/show multiple panels

ITWhisperer — Mon, 17 Apr 2023 07:47:40 GMT

Please explain what each part of the dashboard is trying to do and how it is trying to do it?

Re: Multiselect input to hide/show multiple panels

mnj1809 — Mon, 17 Apr 2023 08:07:15 GMT

Thanks for your prompt response.
I just want to show and hide panels based on the selection of values in Multiselect Input. For example, If I select "Windows" in the multiselect input then only panel "Windows Request Count" should be shown and if I select "Windows" and "NIX" in the multiselect input then panels "Windows Request Count" and NIX Request Count" should be shown.

Re: Multiselect input to hide/show multiple panels

ITWhisperer — Mon, 17 Apr 2023 08:11:44 GMT

Add a change handler to the multiselect to set the appropriate tokens based on the selection.

Re: Multiselect input to hide/show multiple panels

mnj1809 — Mon, 17 Apr 2023 09:25:32 GMT

As you can see in my shared dashboard xml, I've added the change handler but it's not working as expected. could you please share another solution to achieve the requirement or update my shared xml please. Please see the attached screenshot for your reference.
I've selected "Windows" and "NIX" in the multiselect input but only "Windows Request Count" panel is shown however "NIX Request Count" panel should also be shown.

@ITWhisperer

Re: Multiselect input to hide/show multiple panels

ITWhisperer — Mon, 17 Apr 2023 09:47:09 GMT

Your change handler on the multiselect is unsetting all the tokens, it is not setting any of them based on the input selected. This is where you need to have a change handler.

<form version="1.1"> <label>Multiselect Choice</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="alloptions" searchWhenChanged="true"> <label></label> <choice value="All">All</choice> <choice value="second_choice">second choice</choice> <choice value="third_choicee">third choice</choice> <choice value="fourth_choice">fourth choice</choice> <choice value="fifth_choicee">fifth choice</choice> <delimiter>,</delimiter> <change> <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"All",mvcount('form.alloptions')>1 AND mvfind('form.alloptions',"All")>0,"All",mvcount('form.alloptions')>1 AND mvfind('form.alloptions',"All")=0,mvfilter('form.alloptions'!="All"),1==1,'form.alloptions')</eval> <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval> <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval> <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval> <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval> </change> </input> </fieldset> <row> <panel depends="$second$"> <html> <p>Second Panel</p> </html> </panel> <panel depends="$third$"> <html> <p>Third Panel</p> </html> </panel> <panel depends="$fourth$"> <html> <p>Fourth Panel</p> </html> </panel> <panel depends="$fifth$"> <html> <p>Fifth Panel</p> </html> </panel> </row> </form>

Re: Multiselect input to hide/show multiple panels

mnj1809 — Mon, 17 Apr 2023 10:34:07 GMT

This given solution works perfectly. But my requirement is to use value="*" for "All" as I need to use this value in other panels. could you please share the updated dashboard xml having
<choice value="*">All</choice>

@ITWhisperer

Re: Multiselect input to hide/show multiple panels

ITWhisperer — Mon, 17 Apr 2023 11:41:44 GMT

<form version="1.1"> <label>Multiselect Choice</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="alloptions" searchWhenChanged="true"> <label></label> <choice value="*">All</choice> <choice value="second_choice">second choice</choice> <choice value="third_choice">third choice</choice> <choice value="fourth_choice">fourth choice</choice> <choice value="fifth_choice">fifth choice</choice> <delimiter>,</delimiter> <change> <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')>1 AND mvfind('form.alloptions',"\\*")>0,"*",mvcount('form.alloptions')>1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval> <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval> <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval> <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval> <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval> </change> </input> </fieldset> <row> <panel depends="$second$"> <html> <p>Second Panel</p> </html> </panel> <panel depends="$third$"> <html> <p>Third Panel</p> </html> </panel> <panel depends="$fourth$"> <html> <p>Fourth Panel</p> </html> </panel> <panel depends="$fifth$"> <html> <p>Fifth Panel</p> </html> </panel> </row> </form>

Re: Multiselect input to hide/show multiple panels

mnj1809 — Mon, 17 Apr 2023 11:55:24 GMT

Thank you so much. Works perfectly !!!
@ITWhisperer