topic Re: Display different panel depends on selected name in the chart in Dashboards & Visualizations

Display different panel depends on selected name in the chart

krusovice — Mon, 12 Mar 2018 03:25:51 GMT

Hello there,

I've a requirement to design a panel depends on the clicked name in the chart.

For example my chart is to display the count of the country for 3 type of requests (panel1). Depends on the type of request, panel2 should display a table, the format of table for 3 type of requests are difference. Therefore desired output should be click on requestA - display tableA, click on requestB - display tableB and etc.

How can I achieve this requirement? Thanks.

Re: Display different panel depends on selected name in the chart

deepashri_123 — Mon, 12 Mar 2018 06:04:28 GMT

Hey krusovice,

You can refer the following link:
https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html

https://socprime.com/en/blog/using-depends-panels-in-splunk-for-creating-convenient-drilldowns/

Let me know if this helps!!

Re: Display different panel depends on selected name in the chart

krusovice — Mon, 12 Mar 2018 06:43:49 GMT

Hi @deepashri,

Thanks for the reply.

I've reviewed the codes provided, it is mainly for the input source either from dropdown or bullet selection. My main panel(panel1) which showing request type is from the regex and it is showing as pie chart. The token set for this panel1 is

 <set token="clicked_request">$click.name2$</set>

How can I set the condition of the next panel based on the $click.name2$?

Re: Display different panel depends on selected name in the chart

deepashri_123 — Mon, 12 Mar 2018 06:53:41 GMT

So in the next panel you have to add filter as $clicked_request$ that should help!!

Re: Display different panel depends on selected name in the chart

krusovice — Mon, 12 Mar 2018 07:13:05 GMT

That's the exact question, how to set filter for the panel? I cannot use below setting but would like to achieve similar result.

<panel depends="$clicked_request$" = "RequestA">

Re: Display different panel depends on selected name in the chart

deepashri_123 — Mon, 12 Mar 2018 07:59:33 GMT

Depending on the request, your search query for the second panel should have filter.
Something link dis:
index=* request=$clicked_request$ | query.
So when in the first panel request is selected , the second panel will run the query with the request filter and will display result for that filter

And in ur xml it should just be

 <panel depends="$clicked_request$">

Assuming request is the only filter and the query after that is common to all panels.

Re: Display different panel depends on selected name in the chart

krusovice — Mon, 12 Mar 2018 08:33:29 GMT

Thanks, the query after the panel1 is based on selection from the chart (RequestA displays tableA, RequestB displays tableB). Both tables are displaying different data. Just wondering how should I hide the panel for tableB if the selection received is requestA?

Re: Display different panel depends on selected name in the chart

deepashri_123 — Mon, 12 Mar 2018 08:44:11 GMT

I am not sure if this will work, but you can try this:
You can refer this link below :
https://answers.splunk.com/answers/378092/how-to-hide-panels-based-on-a-search-condition.html

And try condition match.

Re: Display different panel depends on selected name in the chart

krusovice — Tue, 29 Sep 2020 18:22:20 GMT

I found a link:
https://answers.splunk.com/answers/400053/condition-match-and-set-token-in-drilldown-not-wor-1.html

Tried to form similar query but the next panel (panel_a or panel_b) is not displaying but it is showing the search dashboard with query in panel_a/panel_b. I really need some expertise advice here.

        <drilldown>
            <condition match="'click.name2' == 'RequestA'">
                    <set token="panel_a">true</set>
                    <unset token="panel_b"></unset>
                </condition>
            <condition match="'click.name2' == 'RequestB'">
                    <set token="panel_b">true</set>
                    <unset token="panel_a"></unset>
                </condition>
            </drilldown>

Re: Display different panel depends on selected name in the chart

niketn — Mon, 12 Mar 2018 19:34:43 GMT

@krusovice, you should read Splunk documentation about predefined drilldown tokens for chart to understand which one to use under what scenario. Usually, $click.name$ is the first column (if you consider data in tabular format) or x-axis (if it is in xy chart). Similarly $click.value$ is the clicked value in the first column or x-axis. Then $click.name2$ is the second column or y-axis with its corresponding value as $click.value2$ . In case Time is being depicted in the chart, it is usually the first column/x-axis so the field with volume depicted over time is y-axis or second column.

With this above understanding you should

    <drilldown>
      <condition match="$click.value$==&quot;RequestA&quot;">
        <set token="tokShowRequestA">RequestA</set>
        <unset token="tokShowRequestB"></unset>
      </condition>
      <!-- Else Condition always hit for RequestB-->
      <condition>
        <unset token="tokShowRequestA"></unset>
        <set token="tokShowRequestB">RequestB</set>
      </condition>
    </drilldown>

PS: While you are using depends attribute for showing or hiding the panels. You should ensure that you use the same token in the query also, so that it keeps waiting for input and does not run for the panel which is not being displayed.

Following is a run anywhere example based on Splunk's _internal index which displays Warning or Error table based on clicking of Pie Slice:

 <form>
  <label>Table based on Pie Chart Click</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label>Select Time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="ERROR" OR log_level="WARN"
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <set token="tokShowWarn">WARN</set>
            <unset token="tokShowError"></unset>
          </condition>
          <!-- Else Condition always hit for ERROR-->
          <condition>
            <unset token="tokShowWarn"></unset>
            <set token="tokShowError">ERROR</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$tokShowWarn$">
        <title>Warning Table</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokShowWarn$" component=*
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
      <table depends="$tokShowError$">
        <title>Error Table</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokShowError$" component=*
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Re: Display different panel depends on selected name in the chart

krusovice — Tue, 29 Sep 2020 18:25:21 GMT

Hi @niketn,

Thanks for the detailed explanation. I've a difficulty as the token to be conditionally matched is not from the panel itself. I pasted partial of the query for 2 panels as below.

<form>
  <label>DAILY REPORT</label>
  <fieldset autoRun="false" submitButton="false">
    <input type="time" token="date">
      <label>DATE</label>
      <default>
        <earliest>@y</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>DAILY VIEW based on Request A B C</title>
      <chart>
        <search>
          <query>index=* 
| rex field=_raw max_match=0 "RequestA\s\-\sCountry\:\s(?&lt;acountry&gt;[\w+]+)" 
| rex field=_raw max_match=0 "RequestB\s\-\sCountry\:\s(?&lt;bcountry&gt;[\w+]+)"
| rex field=_raw max_match=0 "RequestC\s\-\sCountry\:\s(?&lt;ccountry&gt;[\w+]+)"
| stats count(acountry) as "Request A", count(bcountry) as "Request B", count(ccountry) as "RequestC" by date_hour
| sort date_hour</query>
          <earliest>$date.earliest$</earliest>
          <latest>$date.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="clicked_request">$click.name2$</set>
          <set token="clicked_time">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$show_panel$">
      <title>Country count based on $clicked_request$</title>
      <chart>
        <search>
          <query>index=* date_hour="$clicked_time$"
| rex field=_raw max_match=0 "$clicked_request$.*Country\:\s(?&lt;country&gt;[^\s]+)"
| chart count(date_hour) by country</query>
          <earliest>$date.earliest$</earliest>
          <latest>$date.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">none</option>
        <drilldown>
          <condition match="$click.value$=='RequestA'">
            <set token="Apanel">RequestA</set>
            <set token="clicked_country">$click.value$</set>
            <unset token="Bpanel"></unset>
          </condition>
          <!-- Else Condition always hit for RequestB-->
          <condition>
            <unset token="Apanel"></unset>
            <set token="Bpanel">"RequestB"</set>
            <set token="clicked_country">$click.value$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$Apanel$">

    ....
    ....
    ....

As you can see, clicked_request is from the first panel to display the total request based on date_hour. Once it is clicked, the next panel then will show the country count of that request. The challenge is for the third panel - which is a table with 2 input types (dropdown), and display the details of request A/B/C (based on clicked_request from first panel). How can I pass the value from panel 1 or is there better way to achieve this?

Your help is very much appreciated. Thank you in advance.

Re: Display different panel depends on selected name in the chart

niketn — Wed, 14 Mar 2018 11:03:34 GMT

@krusovice would it be possible for you to post a screenshot of your current dashboard? You can mock or anonymize sensitive data. It is difficult to understand the code without sample data which will be displayed in each panel.

In the second panel for Country count based on ..., will you have requestA and requestB as pie slices? Or will it be country names?

If country names are going to be your pie slices, you should try the following <condition> for the <drilldown>:

       <condition match="$clicked_request$==&quot;RequestA&quot;">

If this does not work do paste a screenshot ( you can use image sharing site like imgur and paste the link in comment using Image <img> button or Ctrl+G.

Re: Display different panel depends on selected name in the chart

krusovice — Thu, 15 Mar 2018 03:08:59 GMT

Hi @niketnilay,

Thanks for the reply.

I've uploaded the dashboard image to https://imgur.com/izRwRbd

I've tried both of these 2 condition match setting but it is not working.

 <condition match="$clicked_request$=='RequestA'">

<condition match="match($clicked_request$,'RequestA')">

Thanks for taking a look to my problem.

Re: Display different panel depends on selected name in the chart

niketn — Thu, 15 Mar 2018 13:46:18 GMT

I think request was to use " not '.

<condition match="$clicked_request$==&quot;RequestA&quot;">

Re: Display different panel depends on selected name in the chart

niketn — Thu, 15 Mar 2018 13:51:40 GMT

Following is a run anywhere dashboard based on Splunk's _internal log based on sample screenshot and code shared.
The second drilldown with condition states before is working as expected.

<condition match="$clicked_request$==&quot;RequestA&quot;">

<form>
  <label>Table based on Pie Chart Click</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label>Select Time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" component!="Metrics"
| timechart span=1h count by log_level
| rename INFO as "RequestA"
| rename ERROR as "RequestB"
| rename WARN as "RequestC"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="clicked_request">$click.name2$</set>
          <set token="clicked_time">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
    <panel depends="$show_panel$">
      <chart>
        <title>$clicked_request$</title>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" component!="Metrics"
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <!-- RequestA -->
          <condition match="$clicked_request$==&quot;RequestA&quot;">
            <set token="Apanel">RequestA</set>
            <unset token="Bpanel"></unset>
            <unset token="Cpanel"></unset>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <!-- RequestB -->
          <condition match="$clicked_request$==&quot;RequestB&quot;">
            <unset token="Apanel"></unset>
            <set token="Bpanel">RequestB</set>
            <unset token="Cpanel"></unset>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <!-- RequestC -->
          <condition match="$clicked_request$==&quot;RequestC&quot;">
            <unset token="Apanel"></unset>
            <unset token="Bpanel"></unset>
            <set token="Cpanel">RequestC</set>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <condition>
            <!-- DO NOTHING -->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$Apanel$">
        <title>$Apanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$" component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
      <chart depends="$Bpanel$">
        <title>$Bpanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$"  component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
      <chart depends="$Cpanel$">
        <title>$Cpanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$"  component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
    </panel>
  </row>
</form>

Re: Display different panel depends on selected name in the chart

krusovice — Fri, 16 Mar 2018 03:17:35 GMT

Thank you @niketnilay for the guidance and help. I was in impression that

the "&quot;" is equivalent to " ' " in xml.

It is working great as expected result now.