topic Re: query/Panel should be changed based on token passage value in Dashboards & Visualizations

query/Panel should be changed based on token passage value

sahana — Mon, 31 Jan 2022 13:19:41 GMT

Hi,

I have requirement like the drilldown panel query should be changed based on the token value passed from the parent panel

right now the condition is I have a parent panel token which may pass either SUCCESS or FAILURE as value

If it FAILURE the drilldown panel should execute different query and for SUCCESS it should execute different one

Re: query/Panel should be changed based on token passage value

ITWhisperer — Mon, 31 Jan 2022 13:30:56 GMT

There are a couple of ways to do this:

You could use the drilldown to hide or display whichever panel represents the choice made i.e. you have two drilldown panel and only show one of them. This is done with the depends attribute on the panel

The other way is to use the drilldown to set tokens which are used in the search for the drilldown panel

Re: query/Panel should be changed based on token passage value

diogofgm — Mon, 31 Jan 2022 13:49:00 GMT

Hi Sahana,

You can set a token to the complete search you what to use on either case.
In this example I placed the search in the values of the dropdown.

<form> <label>drilldown</label> <fieldset submitButton="false"> <input type="dropdown" token="filter" searchWhenChanged="true"> <label></label> <choice value="index=_internal">All</choice> <choice value="index=_internal log_level=info">Info</choice> <choice value="index=_internal log_level=error">Error</choice> </input> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>$filter$ |stats count by log_level </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">search?q=$filter$%20log_level%3D$click.value$&earliest=$field1.earliest$&latest=$field1.latest$</link> </drilldown> </table> </panel> </row> </form>

Its easier to work with and help you with what you have right now and what is your objective if you're able to share that.
Check the docs as they have great information on how tokens work and can be used.
https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/ContextualDrilldown

Re: query/Panel should be changed based on token passage value

sahana — Mon, 31 Jan 2022 16:44:41 GMT

Can you give me some examples pls