topic Re: How to run search only for shown panels? in Splunk Search

How to run search only for shown panels?

naty — Sun, 08 Jan 2017 15:13:58 GMT

Hi,

i have a dashboard with several panels.
i have used the "depends" option for every panel to see only those that i need.

what i have noticed is even though i have this option, still all the panels would start the search as soon as the page loads and not when only shown.

meaning, when i open the dashboard i see nothing.
i'm inputting some data for tokens (interval, time, etc).
then i choose the panels i would like to show.
for each panel i have used the depends and rejects options to see only those that matter to that subject.
i have noticed that after inputting all the data needed, all the panels would make their search, no matter if the depends is on them.

my goal is that only that shown panels would start the search and show their output.
we are using Splunk 6.5.1

How can it be done?

Thank you!

Re: How to run search only for shown panels?

somesoni2 — Sun, 08 Jan 2017 15:17:47 GMT

Best option would be to include the depends token that you used for panel in the panel search, so that searches will not run untill that token is set (and thus panel is visible). E.g. If you're setting a token say $showPanel1$ with value say "Y", then in the base search (first portion) of the panel search, add a condition "$showPanel1$"="Y".

Re: How to run search only for shown panels?

naty — Sun, 08 Jan 2017 15:35:09 GMT

can you give an example?
if i got it right, you mean something like this:
index=myind source=mysrc "$showPanel1$"="Y" | ...
but doesn't interfere with the search? i'm basically saying to splunk to search for event with showPanel=Y

Re: How to run search only for shown panels?

somesoni2 — Sun, 08 Jan 2017 16:02:33 GMT

It won't. When the token value is evaluated, your search will look like this and should always work.

index=myind source=mysrc "Y"="Y" | ...

Another (better IMO) option you could do is to set value of $showPanel1$ as 1, then your search would look like this

index=myind source=mysrc $showPanel1=1 | ...

Upon evaluation, results in 1=1 which is always true.

index=myind source=mysrc 1=1 | ...

Re: How to run search only for shown panels?

naty — Thu, 09 Feb 2017 17:49:51 GMT

i found a workaround for this.
i'm initializing the tokens at the page load, so no panel is shown for the start.
this is how i achieved it:

<form>
    <init>
        <unset token="a"></unset>
        <unset token="b"></unset>
        <unset token="c"></unset>
        ...

      </init>
</form>

in the tag you can initialize many things, here is a link to the tag description:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load