topic Re: How to display panels dynamically depends on selection ? in Dashboards & Visualizations

How to display panels dynamically depends on selection ?

Jouman — Thu, 24 Aug 2023 04:50:59 GMT

Hi All,

Previously, I have asked a question titled as "How to display panels dynamically depends on selection ?" (link).

I have a similar issue that I need to display panels dynamically depends on user selection in a filter.

However, the user selection is no longer in categories, but from the packet_size in index="my index" within 24 hours.

Therefore, the options in this filter becomes dynamic and what the user selects is dynamic as well.

This is the search code in this filter:

index="my_idx" "*PING DATA*" | stats count by ping_pkt_size

and the output will be:

ping_pkt_size	Count
40	111
128	30
520	10

... other ping_pkt_size are possible.

Is it possible to display panels accordingly and dynamically depends on user selection? ex. if the user selects 40, then display the analysis table for packet_size=40. If the user selects 128 and 520, then display 2 analysis tables, one for packet_size=128 and one for packet_size=520.

Do anyone have idea about how to implement this?

Thank you.

Re: How to display panels dynamically depends on selection ?

isoutamo — Thu, 24 Aug 2023 07:47:11 GMT

You should use that filter search for generate selection list. Here is couple of old answers:

You could find more information from Splunk visualisation documentations.

r. Ismo

Re: How to display panels dynamically depends on selection ?

ITWhisperer — Thu, 24 Aug 2023 08:56:49 GMT

Panels can be hidden / shown with the depends attribute, however, they still have to be defined. This means you would have to know / decide on the maximum number of panels you want to show. (An alternative to this is to use trellis layout, but this isn't available for table / event panels.)

<form version="1.1"> <label>Multiselect</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="packetsize" searchWhenChanged="true"> <label>Packet Size</label> <search> <query> ``` Query to generate packet sizes dynamially ``` | makeresults | eval packetsize=split("40,128,520",",") | mvexpand packetsize </query> </search> <fieldForValue>packetsize</fieldForValue> <fieldForLabel>packetsize</fieldForLabel> <delimiter>,</delimiter> <change> <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval> <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval> <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval> <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval> <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval> </change> </input> </fieldset> <row> <panel depends="$firstpacketsize$"> <title>First Panel</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$firstpacketsize$" </query> </search> <option name="drilldown">cell</option> </table> </panel> <panel depends="$secondpacketsize$"> <title>Second Panel</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$secondpacketsize$" </query> </search> </table> </panel> <panel depends="$thirdpacketsize$"> <title>Third Panel</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$thirdpacketsize$" </query> </search> </table> </panel> <panel depends="$fourthpacketsize$"> <title>Fourth Panel</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$fourthpacketsize$" </query> </search> </table> </panel> <panel depends="$fifthpacketsize$"> <title>Fifth Panel</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$fifthpacketsize$" </query> </search> </table> </panel> </row> </form>

Re: How to display panels dynamically depends on selection ?

Jouman — Thu, 31 Aug 2023 05:33:06 GMT

thank you so much. This works!