topic Re: If it is possible to have query/panel with conditional alternative queries/panels? in Dashboards & Visualizations

Is it possible to have query/panel with conditional alternative queries/panels?

yshen — Tue, 18 Oct 2022 17:17:18 GMT

As follows
if <condition-based-on-token-value> then query_1 else query_2where query_1 and query_2 may be a series of statements producing different sets of data.

Given a search query can be embedded in a panel, it might achieve the equivalent results, if there were a way to have conditional panel selection:
if <condition-based-on-token-value> then panel_with_query_1 else panel_with_query_2
(The above idea is inspired by @mmccul)
but I don't know if it's possible to have such panel selection mechanism with Simple XML of Splunk?Or alternatively, if I could control the visibility of a panel based token value, then I might also achieve the panel selection mechanism:

define two panels with visibility control by the token value
the controls are mutually exclusive, so that only one panel will be shown

I'd appreciate some pointers or examples. (edited)

Re: If it is possible to have query/panel with conditional alternative queries/panels?

richgalloway — Fri, 28 Jan 2022 18:36:55 GMT

You should be able to use the depends option on a panel to control whether it is visible or not. The depends option says the panel is visible if the specified token is defined. Using conditions to set an un-set tokens will show/hide the panels.

Re: If it is possible to have query/panel with conditional alternative queries/panels?

yshen — Sat, 29 Jan 2022 00:17:05 GMT

Thanks for the solution!

Here is a minimum working example:

<form>
<label>Select between Current and Forecast Weather</label>
<fieldset submitButton="false">
<input type="radio" id="forecast" token="forecastToken" searchWhenChanged="true">
<label></label>
<choice value="0">Current</choice>
<choice value="1">Forecast</choice>
<default>0</default>
<change>
<condition value="0">
<set token="showCurrent">1</set>
<unset token="showForecast"></unset>
</condition>
<condition value="1">
<set token="showForecast">1</set>
<unset token="showCurrent"></unset>
</condition>
</change>
<initialValue>0</initialValue>
</input>
</fieldset>
<row>
<panel depends="$showCurrent$">
<single>
<title>Weather</title>
<search depends="$showCurrent$">
<query>| makeresults
| eval weather="Current"</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel depends="$showForecast$">
<single>
<title>Weather</title>
<search depends="$showForecast$">
<query>| makeresults
| eval weather="Forecast"</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</form>

Re: If it is possible to have query/panel with conditional alternative queries/panels?

eholz1 — Tue, 18 Oct 2022 16:44:48 GMT

Hello and I need some help on simple xml and dashboards

I have a token "hide_panel"

I have two panels - one gets an "Off" (panel1) result in the search, the other panel (panel2) gets an "On" result in the search.

I want to show the "On" panel when the dashboard opens, and if a search is run on panel1 - that has ";Off" in the result, hide panel2.

I am not understanding the tags: <progress> I do have a sample that works using a dropdown - but have yet

to understand how to set and unset the token so panel2 shows first, and then hides

My code is like this:

<search>
<query>sourcetype=linux_secure user=* eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UserAction) by Date,host,user | sort - Date
| where 'last(UserAction)' == "Off"</query>
<earliest>-35m@m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.UserAction' == Off">

</condition>
<condition match="'job.UserAction' == Off">
<set token="hide_panel">false</set >
</condition>

</progress>

<sampleRatio>1</sampleRatio>
</search>

Any suggestions will help,

thanks,

eholz1

Re: If it is possible to have query/panel with conditional alternative queries/panels?

richgalloway — Tue, 18 Oct 2022 17:34:36 GMT

Based on the code you shared, you probably want the <done> tag.

Re: If it is possible to have query/panel with conditional alternative queries/panels?

eholz1 — Tue, 18 Oct 2022 17:42:26 GMT

Hello richgalloway,

Thanks are not enough for the help provided by this forum and your replies, I will try the "done" tag.

thanks again,

eholz1