topic Re: If else condition for dashboard in Dashboards & Visualizations

If else condition for dashboard

tamduong16 — Tue, 29 Sep 2020 17:14:53 GMT

How can I do an if token=something then run this query for the panel and else to run another query for that same panel?
So I have the following query:

query 1:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "Name" = substr(Name,1,3)
| eval "Name" = upper(Name)
| rex field=Name mode=sed "s/AAA/APAC/g"
| rex field=Name mode=sed "s/ABC/ABCD3/g"
| rex field=Name mode=sed "s/CDF/CDF123/g"
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

query2:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

How can I make my dashboard panel to run query 1 if the token value is "All", and if else for query 2, else for maybe other query? Can I do this with splunk?
Thanks

Re: If else condition for dashboard

DalJeanis — Thu, 14 Dec 2017 21:31:26 GMT

Put both panels in the same place, and set a token for depends in one, and for rejects in the other. When the token exists, the depends panel will show, when the token does NOT exist, then the rejects panel will show.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML

Re: If else condition for dashboard

cmerriman — Thu, 14 Dec 2017 21:33:03 GMT

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-order.html
this is a blog post for help on it.

Re: If else condition for dashboard

jkat54 — Mon, 01 Jul 2019 16:43:48 GMT

You can also use <condition label="YOUR_CHOICE_LABEL"> which is good for when you have a choice of "All" with value of "*".