topic Re: Chnaging panel query based on token in Dashboards & Visualizations

Chnaging panel query based on token

BearMormont — Wed, 21 Mar 2018 23:25:16 GMT

I have a dashboard with a base search that feeds a simple panel like below. Is it possible to change the <query> based on a token? For example, let's say the token $tknIncludeField2$ is set to false. I would want the query instead to read | stats list(Field1) by Field3

Is that possible?

<panel>
  <title>My Awesome Table</title>
  <table>
    <search base="base">
            <query>
                | stats list(Field1), list(Field2) by Field3
            </query>
    </search>
    <option name="count">10</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
</panel>

Thanks!

Re: Chnaging panel query based on token

damiensurat — Thu, 22 Mar 2018 00:02:24 GMT

you sure can, what you would want to do is set or unset the token based on the condition.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/tokens

notice in the example below the logic to set and unset a token.

   <search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>`enter code here`
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>

so in your situation:

          <condition match=$tknIncludeField2$== 0">
               <set token="field2">"list(Field1)"</set>
           </condition>
           <condition>
               <unset token="field2"/>
           </condition>

But it may be easier to just provide a multiselect form input and then use the values to populate the selectable fields. Here's an example that should do exactly as you are requesting based on your sample (of course you will still need the base query):

 <form>
   <label>a</label>
   <fieldset submitButton="false">
     <input type="multiselect" token="listFieldsChoice" searchWhenChanged="true">
       <label>Field Filter</label>
       <choice value="field1">Field1</choice>
       <choice value="field2">Field2</choice>
       <choice value="field3">Field3</choice>
       <valuePrefix>list(</valuePrefix>
       <valueSuffix>)</valueSuffix>
       <delimiter>, </delimiter>
     </input>
   </fieldset>
   <row>
       <panel>
           <title>My Awesome Table</title>
           <table>
               <search base="base">
               <query>
                 | stats $listFieldsChoice$ by Field3
               </query>
             </search>
             <option name="count">10</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">none</option>
             <option name="percentagesRow">false</option>
             <option name="refresh.display">progressbar</option>
             <option name="rowNumbers">false</option>
             <option name="totalsRow">false</option>
             <option name="wrap">true</option>
         </table>
     </panel>
  </row>
</form>

Re: Chnaging panel query based on token

BearMormont — Thu, 22 Mar 2018 01:06:38 GMT

You rocked my face off!

This is EXACTLY what I needed!

Re: Chnaging panel query based on token

damiensurat — Thu, 22 Mar 2018 11:29:03 GMT

Haha. Great to hear BearMormont! Happy Splunking!