Splunk show a panel dynamically when a non-default text entry is entered (ie. not * )

gjanders — Fri, 02 Jun 2017 03:47:56 GMT

Basically I have an input in a dashboard such as:

<input type="text" token="user" searchWhenChanged="true">
  <label>user</label>
  <default>*</default>
  <change>
    <condition match="$user$ == *">
      <unset token="show_user_panel"/>
    </condition>
    <condition match="$user$ != *">
      <set token="show_user_panel">true</set>
    </condition>        
  </change>
</input>

So the basic idea is that the user field defaults to * (anything) and then if someone enters a non-wildcard value I want to dynamically show a panel that drills down into a per-user information like:

  <row>
    <panel depends="$show_user_panel$">

Except I cannot seem to get the token to set as expected, is there something obvious I'm missing here?
Or is there an easier way to do this?

I also tested:

  <change>
    <condition value="*">
      <unset token="show_user_panel"/>
      <set token="test">true1</set>
    </condition>
    <condition>
      <set token="show_user_panel">true</set>
      <set token="test">true2</set>
    </condition>        
  </change>

That results in it always hitting the "true1" value, and if I quote the * symbol with a single quote or similar it always hits true2 instead...

I also tested:

  <change>
    <condition match="if('user'=='*', true, false)">
      <unset token="show_user_panel"/>
      <set token="test">true1</set>
    </condition>
    <condition>
      <set token="show_user_panel">true</set>
      <set token="test">true2</set>
    </condition>        
  </change>

And

  <change>
    <condition match="case($user$=='*', true)">
      <unset token="show_user_panel"/>
      <set token="test">true1</set>
    </condition>
    <condition>
      <set token="show_user_panel">true</set>
      <set token="test">true2</set>
    </condition>        
  </change>

But I cannot seem to get this working the way I would expect...

Re: Splunk show a panel dynamically when a non-default text entry is entered (ie. not * )

gjanders — Fri, 02 Jun 2017 04:11:22 GMT

I had to change two things, the logic I was using, previously I used using a "*" symbol in the text input panel and then the search was:
index=... data.input.user=$user$
(or similar)

What I have done now is:
index=.... $user$

And prefixed the input entry.

<input type="text" token="user" searchWhenChanged="true">
  <label>user</label>
  <prefix>data.search_props.user=</prefix>
  <change>
    <condition value="">
      <unset token="display_user_panel"></unset>
    </condition>
    <condition value="*">
      <set token="uservalue">$value$</set>
      <set token="display_user_panel">true</set>
    </condition>        
  </change>      
</input>

So now if the text field has an empty value (ie. the field is empty/nothing) then the hidden panel becomes hidden again as:

  <row>
    <panel depends="$display_user_panel$">

Becomes hidden again, and furthermore the hidden panel search now has:
index=... user=$uservalue$

So the input is 1 in place but used for 2 different searches...(I cannot use the prefix here as only the first index has the data.search_props.user prefix)

topic Splunk show a panel dynamically when a non-default text entry is entered (ie. not * ) in Dashboards & Visualizations

Splunk show a panel dynamically when a non-default text entry is entered (ie. not * )

Re: Splunk show a panel dynamically when a non-default text entry is entered (ie. not * )