topic Re: Show/Hide a table depending on a column value from another table in Dashboards & Visualizations

Show/Hide a table depending on a column value from another table

sdhawanx — Mon, 18 Jan 2021 08:55:58 GMT

I have table with just 2 columns 'Name' and 'Value'. one of the rows has the 'Value' as 'Fail', 'Pass' or 'NA'

I have another table, which has a bunch of related data. I have 2 options for the second table:-

1. I want the query for table 2 to run only when the 'Value' in the first table is 'Fail' and the table 2 to remain hidden

2. but I want that table to be only displayed when the 'Value' in the first table is 'Fail'

Re: Show/Hide a table depending on a column value from another table

kamlesh_vaghela — Mon, 18 Jan 2021 09:59:46 GMT

@sdhawanx

Can you please try this xml?

<form> <label>Table Depend</label> <row> <panel> <table> <title>First Table</title> <search> <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <drilldown> <condition match="match($row.val$, "Fail")"> <set token="tkn_value">$row.val$</set> </condition> <condition> <unset token="tkn_value" /> </condition> </drilldown> </table> </panel> </row> <row> <panel> <table depends="$tkn_value$"> <title>Second Table with value $tkn_value$</title> <search> <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

Re: Show/Hide a table depending on a column value from another table

sdhawanx — Tue, 19 Jan 2021 06:20:32 GMT

i added this portion to my simple xml file in the first table

<drilldown>
          <condition match="match($row.val$, &quot;Fail&quot;)">
            <set token="tkn_value">$row.val$</set>
          </condition>
          <condition>
            <unset token="tkn_value" />
          </condition>
</drilldown>

and then

 <table depends="$tkn_value$">

the above portion in the second table. but the second table always remains hidden for some reason no matter what the value is.

Note:- i changed the row.val as per my table requirement still its the same result.

Re: Show/Hide a table depending on a column value from another table

kamlesh_vaghela — Tue, 19 Jan 2021 07:07:45 GMT

@sdhawanx

Is it possible for you to share sample XML of both table.. replace search with dummy search.

Re: Show/Hide a table depending on a column value from another table

sdhawanx — Tue, 19 Jan 2021 08:53:35 GMT

Table 1
<table id="Table_1">
<title>Table 1</title>
<search id="Table_1">
<query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition match="match($row.val$, "Fail")">
<set token="tkn_value">$row.val$</set>
</condition>
<condition>
<unset token="tkn_value" />
</condition>
</drilldown>
<format type="color" field="Log">
<colorPalette type="list">[#FFFFFF,#DC4E41]</colorPalette>
<scale type="threshold">1</scale>
</format>
</table>

Table 2

<table id="Table_2" depends="$tkn_value$">
<title>Table 2</title>
<search id="base_search_35_1">
<query>
| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$" </query>
</search>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>

Re: Show/Hide a table depending on a column value from another table

kamlesh_vaghela — Tue, 19 Jan 2021 10:24:27 GMT

@sdhawanx Your code looks good and working in my instance also. Anything else you did with table drill down?

Re: Show/Hide a table depending on a column value from another table

sdhawanx — Tue, 19 Jan 2021 10:28:21 GMT

there is nothing else in the code apart from the changed query

for the second table i used only this part

| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val

and removed the last pipe. this is the only difference. But as per my understanding the code should still work fine. but the table remains hidden nonetheless.

i created a sample code on my local splunk and copied your code as is and it seemed to work just fine but when transferring it to the main code its not working

Re: Show/Hide a table depending on a column value from another table

kamlesh_vaghela — Tue, 19 Jan 2021 13:35:24 GMT

@sdhawanx

Can you please check the token value by printing it? Just do below changes.

<drilldown> <condition match="match($row.value$, "Fail")"> <set token="tkn_value">$row.value$</set> <unset token="tkn_value_tmp" /> </condition> <condition> <unset token="tkn_value" /> <set token="tkn_value_tmp">$row.value$ Negative</set> </condition> </drilldown>

Add below

<row> <panel> <html>$tkn_value$<br /> $tkn_value_tmp$</html> </panel> </row>

Just observe the behaviour of both token. It will help you to debug more.

Re: Show/Hide a table depending on a column value from another table

sdhawanx — Mon, 25 Jan 2021 06:57:45 GMT

I will test this once i return to work. Thanks for the prompt response. Very much appreciated

Re: Show/Hide a table depending on a column value from another table

nsaveljevas — Tue, 24 Sep 2024 14:25:06 GMT

I was looking for a solution to show / hide tables on my dashboard and the set / unset token were very useful to me. Thanks!