topic Re: How to make panel depend on token value? in Dashboards & Visualizations

How to make panel depend on token value?

matstap — Tue, 29 Sep 2020 18:58:26 GMT

I have 10 panels on a dashboard. I want to have a dropdown menu to select which panel to see (hiding the rest). Say this dropdown has a token called panel_tok. Is there a way to make the panels depend on specific values of panel_tok?

i.e., if I select "A" in the dropdown, only panel "A" should be visible.

Re: How to make panel depend on token value?

niketn — Wed, 11 Apr 2018 04:56:30 GMT

@matstap, following are couple of options you have! Try the run anywhere dashboard examples.

Option 1: set only one depends token on selection of the corresponding panel. At the same time the tokens for other panels should be unset. You would also need to add a dependency of the token being set to specific Panel's Search query so that it runs only when the token is set. This is required since you one to run only 1 search when the dashboard loads, not 10.

    <form>
      <label>Option 1: Dropdown to Show Specific Panel and Hide Others</label>
      <fieldset submitButton="false">
        <input type="dropdown" token="tokShowHidePanel" searchWhenChanged="true">
          <label>Display Panel</label>
          <choice value="panelA">Panel A</choice>
          <choice value="panelB">Panel B</choice>
          <choice value="panelC">Panel C</choice>
          <default>panelA</default>
          <change>
            <condition value="panelA">
              <set token="tokShowPanelA">true</set>
              <unset token="tokShowPanelB"></unset>
              <unset token="tokShowPanelC"></unset>
            </condition>
            <condition value="panelB">
              <unset token="tokShowPanelA"></unset>
              <set token="tokShowPanelB">true</set>
              <unset token="tokShowPanelC"></unset>
            </condition>
            <condition value="panelC">
              <unset token="tokShowPanelA"></unset>
              <unset token="tokShowPanelB"></unset>
              <set token="tokShowPanelC">true</set>
            </condition>
          </change>
        </input>
        <input type="time" token="tokTime" searchWhenChanged="true">
          <label></label>
          <default>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
          </default>
        </input>
      </fieldset>
      <row>
        <panel depends="$tokShowPanelA$">
          <title>Panel A - INFO</title>
          <chart>
            <search>
              <query>index=_internal sourcetype=splunkd log_level="INFO"
    | timechart count by component useother=f usenull=f limit=5
    | eval dummy="$tokShowPanelA$"
    | fields - "$tokShowPanelA$"</query>
              <earliest>$tokTime.earliest$</earliest>
              <latest>$tokTime.latest$</latest>
            </search>
            <option name="charting.chart">area</option>
            <option name="charting.drilldown">all</option>
            <option name="refresh.display">progressbar</option>
          </chart>
        </panel>
        <panel depends="$tokShowPanelB$">
          <title>Panel B - WARN</title>
          <chart>
            <search>
              <query>index=_internal sourcetype=splunkd log_level="WARN"
    | timechart count by component useother=f usenull=f limit=5
    | eval dummy="$tokShowPanelB$"
    | fields - "$tokShowPanelB$"</query>
              <earliest>$tokTime.earliest$</earliest>
              <latest>$tokTime.latest$</latest>
            </search>
            <option name="charting.chart">area</option>
            <option name="charting.drilldown">all</option>
            <option name="refresh.display">progressbar</option>
          </chart>
        </panel>
        <panel depends="$tokShowPanelC$">
          <title>Panel C - ERROR</title>
          <chart>
            <search>
              <query>index=_internal sourcetype=splunkd log_level="ERROR"
    | timechart count by component useother=f usenull=f limit=5
    | eval dummy="$tokShowPanelC$"
    | fields - "$tokShowPanelC$"</query>
              <earliest>$tokTime.earliest$</earliest>
              <latest>$tokTime.latest$</latest>
            </search>
            <option name="charting.chart">area</option>
            <option name="charting.drilldown">all</option>
            <option name="refresh.display">progressbar</option>
          </chart>
        </panel>
      </row>
    </form>

Option 2:
Set the Query to be run in Specific Panel in the dropdown change event handler. Keep only one panel and run the specific query.

<form>
  <label>Option 2: Dropdown to Show Specific Panel and Hide Others</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokShowHidePanel" searchWhenChanged="true">
      <label>Display Panel</label>
      <choice value="panelA">Panel A - INFO</choice>
      <choice value="panelB">Panel B - WARN</choice>
      <choice value="panelC">Panel C - ERROR</choice>
      <default>panelA</default>
      <change>
        <condition value="panelA">
          <set token="tokShowPanelQuery">index=_internal sourcetype=splunkd log_level=&quot;INFO&quot;| timechart count by component useother=f usenull=f limit=5</set>
          <set token="tokPanelTitle">$label$</set>
        </condition>
        <condition value="panelB">
          <set token="tokShowPanelQuery">index=_internal sourcetype=splunkd log_level=&quot;WARN&quot;| timechart count by component useother=f usenull=f limit=5</set>
          <set token="tokPanelTitle">$label$</set>
        </condition>
        <condition value="panelC">
          <set token="tokShowPanelQuery">index=_internal sourcetype=splunkd log_level=&quot;ERROR&quot;| timechart count by component useother=f usenull=f limit=5</set>
          <set token="tokPanelTitle">$label$</set>
        </condition>
      </change>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel depends="$tokPanelTitle$">
      <title>$tokPanelTitle$</title>
      <chart>
        <search>
          <query>$tokShowPanelQuery$</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

PS: I have used three Panels/Queries for Run anywhere Example, but you can extend to the 10 that you need.

Re: How to make panel depend on token value?

Ranazar — Thu, 11 Oct 2018 18:54:32 GMT

Minor typo fix for Option 1 - for the addition to the search queries so that the search only triggers when the token is set. Instead of this

    | eval dummy="$tokShowPanelA$"
     | fields - "$tokShowPanelA$"

It should be this (i.e. the field to hide is dummy). Otherwise the dummy field does show up when the search is run:

    | eval dummy="$tokShowPanelA$"
     | fields - "dummy"

Re: How to make panel depend on token value?

niketn — Thu, 18 Oct 2018 11:08:19 GMT

@Ranazar thanks for the correction. Got to know even better way to do this would be

Option 1) Don't use eval just use the following. If the token does not exist search will not run. If the token exist fields - will not remove anything provided the existing search result does not have any field which may have same name as the value of token $tokShowPanel$

     | fields - "$tokShowPanelA$"

Option 2) Use built in comment macro in Splunk with the token dependency. The comment macro does not execute but adds the dependency with the token.

      `comment("RUN SEARCH ONLY WHEN $tokShowPanelA$ IS SET")`

Re: How to make panel depend on token value?

Ranazar — Fri, 19 Oct 2018 15:34:05 GMT

Oh, that's just brilliant! I know there's documentation and dashboard examples that probably cover this sort of thing, but it's near impossible to find time for that. Coming across these posts is super helpful.

Re: How to make panel depend on token value?

mvohra_arcusdat — Tue, 18 Dec 2018 13:42:33 GMT

Excellent example.

I am looking for option/setting which would make the panel execute the search only on certain condition.

Right now, the searches run with default values and they cause the dashboard to take a very long time and heavy load on the SH.

Suggestions and guidance much appreciated.

-MV

Re: How to make panel depend on token value?

gjanders — Wed, 22 Jan 2020 05:42:00 GMT

I know this is quite an old post but the first to come up in google, I've confirmed that newer versions of Splunk allow:

<search depends="$token$">

Newer versions of the Simple XML Reference documentation also states this...(I checked as far back as 7.0.0 and it appears to be there)

Re: How to make panel depend on token value?

matthaeus — Thu, 03 Sep 2020 07:42:35 GMT

Hey there, I'm trying to implement this into one of my dashboards but have run into a problem.

I've implemented the option 2 and it works really well so far. However I would like to be able to not only select an option in the dropdown, but also by clicking on a value in another panel. And while I've implemented the drilldown, and the selected value shows up in my dropdown, the corresponding search is not getting executed. Instead the selected value is just getting added in the dropdown list although the same value is already existing.
Could anyone help me out here?

Re: How to make panel depend on token value?

TheEggi98 — Wed, 18 Jan 2023 13:28:07 GMT

Not the most recent Topic, but it got shown first, so i'll post my approach here.

Recently i had similar difficulties and ended up with a solution with way less lines and without much <set> ans <unset>

Dropdown:

<input type="dropdown" token="dropdownTok" searchWhenChanged="true"> <label>dropdown</label> <choice value="all">All</choice> <choice value="1">Entry1</choice> <choice value="2">Entry2</choice> <choice value="3">Entry3</choice> <choice value="4">Entry4</choice> <change> <eval token="DisplayPanel1">if($value$="1",true(),if($value$="all",true(),null()))</eval> <eval token="DisplayPanel2">if($value$="2",true(),if($value$="all",true(),null()))</eval> <eval token="DisplayPanel3">if($value$="3",true(),if($value$="all",true(),null()))</eval> <eval token="DisplayPanel4">if($value$="4",true(),if($value$="all",true(),null()))</eval> </change> <default>all</default> </input>

That couple of lines inside <change> allows to set/unset the Tokens without <condition>
I simply can u8se depends="$DisplayPanel2$" and that Row/Panel only shows up when all or Entry2 is selected

Re: How to make panel depend on token value?

annisha26 — Wed, 15 Mar 2023 06:25:08 GMT

hi @niketn ,

I want to be able show more than one pannel at time Using a multiselect or check box is there any solution for this.

Re: How to make panel depend on token value?

TheEggi98 — Wed, 15 Mar 2023 07:17:12 GMT

@annisha26
You can easily do that with the following:

<input type="multiselect" token="panelTok" searchWhenChanged="true"> <label>select Panels to show</label> <choice value="1">Entry1</choice> <choice value="2">Entry2</choice> <choice value="3">Entry3</choice> <choice value="4">Entry4</choice> <change> <eval token="DisplayPanel1">if(isnull(mvfind($panelTok$, "1")),null(),true())</eval> <eval token="DisplayPanel2">if(isnull(mvfind($panelTok$, "2")),null(),true())</eval> <eval token="DisplayPanel3">if(isnull(mvfind($panelTok$, "3")),null(),true())</eval> <eval token="DisplayPanel4">if(isnull(mvfind($panelTok$, "4")),null(),true())</eval> </change> </input>

Re: How to make panel depend on token value?

bowesmana — Wed, 15 Mar 2023 07:56:50 GMT

Note that <change> is not officially supported for multiselect inputs, so it may not always work

Also, it's always a good idea to ask a new question and refer by link to an old thread if necessary - often old answered questions will not be seen and the original responders may not active any more to answer questions from that thread.

Re: How to make panel depend on token value?

annisha26 — Wed, 15 Mar 2023 09:03:42 GMT

@TheEggi98 thank you will try this.

Re: How to make panel depend on token value?

TheEggi98 — Wed, 15 Mar 2023 09:46:26 GMT

Oh, I didnt knew that.

Where is that info?
In the Docs Define tokens for conditional operations with form inputs i cant find that info.

Re: How to make panel depend on token value?

bowesmana — Wed, 15 Mar 2023 22:37:09 GMT

It's documented here

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#input_.28form.29

in the Shared input child elements section.

It does seem to work generally, but I remember a couple of years ago finding a use case, where it did not work as expected, so I'm not totally sure if it really does or does not.

Re: How to make panel depend on token value?

carbdb — Thu, 03 Aug 2023 08:55:00 GMT

my recent experience in having chained searches depending on token:

<query>| eval run="$run$"

...</query>

</search>

Re: How to make panel depend on token value?

tomapatan — Fri, 10 Nov 2023 17:48:56 GMT

great answer, was very useful, thanks.