topic How to pass a token in one dashboard that will impact other panel based on values? in Splunk Search

How to pass a token in one dashboard that will impact other panel based on values?

smanojkumar — Fri, 31 Mar 2023 16:50:07 GMT

Hi There,

I had a panel "OS", that gives the value os,

based on the value of os,

if it were "Windows" it should display a panel "defender version", not "Agent version"

If it were "MAC" it should display "Agent version", not "defender version"

I don't need drop down by selecting the values in "OS" panel, The os values wants to make impact on choosing the panel.

Thanks in Advance!

Re: passing a token in one dashboard and it will impact other panel based on values

ITWhisperer — Fri, 31 Mar 2023 09:39:42 GMT

Please share what you currently have i.e. what searches and panels have you already created?

Re: passing a token in one dashboard and it will impact other panel based on values

smanojkumar — Fri, 07 Apr 2023 09:29:42 GMT

Hi @ITWhisperer ,

The pannel "OS" is

| inputlookup lookupfilekvstore | fields name, os | search name IN ($name$) | table os

, the panel when os="Windows"

| inputlookup lookupfilekvstore | fields name, defender | search name IN ($name$) | table defender

, the panel when os="MAC" OR "OS - X"

| inputlookup lookupfilekvstore | fields name, agent | search name IN ($name$) | table agent

Re: passing a token in one dashboard and it will impact other panel based on values

ITWhisperer — Fri, 31 Mar 2023 09:58:23 GMT

If you are using SimpleXML dashboards, you can add a done handler to the first search which sets tokens depending on the os, and have depends attributes on the Windows and Mac panels to show them as appropriate.

Re: passing a token in one dashboard and it will impact other panel based on values

smanojkumar — Mon, 03 Apr 2023 06:03:45 GMT

Hi @ITWhisperer ,

Can you please help me in adding the done handler in the search,

Thanks!

Re: passing a token in one dashboard and it will impact other panel based on values

ITWhisperer — Mon, 03 Apr 2023 06:49:00 GMT

<search> <query> | inputlookup lookupfilekvstore | fields name, os | search name IN ($name$) | table os </query> <done> <eval token="osname">$result.os$</eval> </done> </search>

Re: passing a token in one dashboard and it will impact other panel based on values

smanojkumar — Fri, 07 Apr 2023 09:32:52 GMT

I tried using, I'm having some error, here is the full query
I need Agent version panel when os is "MAC" or "OS X" or "IOS" , i need defender sig version if the os is "windows" or "windows 7" or "windows*"

<form theme="dark"> <label> ASSET STATUS</label> <fieldset submitButton="false" autoRun="true"> <input type="radio" token="category" searchWhenChanged="true"> <label>Category</label> <choice value="work">Work</choice> <choice value="auto">Auto</choice> <choice value="server">Server</choice> <search> <query/> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>work</default> <change> <condition value="work"> <set token="Work">"Work"</set> <unset token="Auto"></unset> </condition> <condition value="auto"> <set token="Auto">"Auto"</set> <unset token="Work"></unset> </condition> <condition value="server"> <set token="Server">"Server"</set> <unset token="Work"></unset> <unset token="Auto"></unset> </condition> </change> </input> <input type="text" token="src_name" searchWhenChanged="true"> <label>src_name</label> <default>*</default> </input> </fieldset> <row> <panel> <title>OS</title> <single> <search> <query>| inputlookup $category$_sanity_check_kvstore | fields src_name, os | search src_name IN ($src_name$) | table os</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="rangeColors">["0xdc4e41","0x53a051"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel depends="$Work$"> <title>Defender Sig Version</title> <single> <search> <query>| inputlookup $category$_sanity_check_kvstore | fields src_name, defender_sig_version_check | search src_name IN ($src_name$) | table defender_sig_version_check</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0xdc4e41","0x53a051"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel> <title>Agent Version</title> <single> <search> <query>| inputlookup $category$_sanity_check_kvstore | fields agentVersion_value,base_agentVersion_value, src_name | search src_name IN ($src_name$) | eval edr_mac_check=if(agentVersion_value>=base_agentVersion_value,3,0) | table edr_mac_check</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0xdc4e41","0x53a051"]</option> <option name="rangeValues">[0]</option> <option name="useColors">1</option> </single> </panel> </row>

Re: passing a token in one dashboard and it will impact other panel based on values

ITWhisperer — Fri, 07 Apr 2023 09:16:15 GMT

How does this implement the suggestions made?

Re: passing a token in one dashboard and it will impact other panel based on values

smanojkumar — Fri, 07 Apr 2023 09:25:42 GMT

Error in the sense, how to select panel based on the output of OS, I need that as well, we are done with passing the result and need help to select panel based on the output of OS