topic Re: Dashboard filter should work on a tabular panel without the visibility of that filter column? in Splunk Search

How to achieve dashboard filter on a tabular panel without the visibility of that filter column?

Vish — Wed, 26 Apr 2023 12:55:52 GMT

So I have a tabular chart as below with component, basket and ageing for 1 to 10 days.

So basically i am finding out the ageing of each component and also a basket filter to filter out the component based on different basket.

But i don't want the basket column to be in my tabular chart like if u can see the last 2 rows are of same component but different basket now i want a single row of each component and i will add a filter using the basket column and it has to filter out according but my below tabular chart should be change to a tabular chart having only component column and age column (and only one row for each component).

So is it possible to do it. If yes, please help out.

Re: Dashboard filter should work on a tabular panel without the visibilty of that filter column

seemanshu — Tue, 25 Apr 2023 11:59:28 GMT

Hi @Vish ,
As per the requested query,
the following search could be used,

index=<index_name> sourcetype=<sourcetype_name>
| table COMPONENT, BASKET, AGE
| search BASKET=$tok_basket$
| fields - BASKET

Here, the filter $tok_basket$ passes the BASKET number as the user selects and filters out the results.

Kindly support the answer if found helpful.

Re: Dashboard filter should work on a tabular panel without the visibilty of that filter column

Vish — Wed, 26 Apr 2023 04:15:48 GMT

@seemanshu This is valid if the Basket has to be removed from output but i want the rows to be combined as a single row, like the last 2 rows of my below picture as to be a single row

Re: Dashboard filter should work on a tabular panel without the visibility of that filter column?

VatsalJagani — Wed, 26 Apr 2023 05:38:50 GMT

@Vish - Your query would be something like this to achieve it.

..... <your original search> .... | search BASKET=$tok_basket$ | stats values(AGE) as AGE by COMPONENT

Here in this query, $tok_basket$ is filtering the results as you asked.
And then | stats ... by COMPONENT as you asked to get only one line instead of multiple lines.

Kindly upvote if you found it helpful!!!

Re: Dashboard filter should work on a tabular panel without the visibility of that filter column?

seemanshu — Wed, 26 Apr 2023 05:50:25 GMT

Hi @Vish ,
Thanks for the update.
As per the recent requirement, if the rows with similar COMPONENT are required to be combined in a single row, then one of the following options could be used,

if the BASKET is required in the final result, then use the following search,

index=<index_name> sourcetype=<sourcetype_name> | table COMPONENT, BASKET, AGE | search BASKET=$tok_basket$ | stats values(AGE) as AGE, values(BASKET) as BAKSET by COMPONENT

if BASKET is NOT required in the final results, then use the following search,

index=<index_name> sourcetype=<sourcetype_name> | table COMPONENT, BASKET, AGE | search BASKET=$tok_basket$ | stats values(AGE) as AGE by COMPONENT

Here, the filter $tok_basket$ passes the BASKET number as the user selects and filters out the results.

Kindly support the answer if found helpful.

Re: Dashboard filter should work on a tabular panel without the visibility of that filter column?

Vish — Thu, 27 Apr 2023 04:11:08 GMT

The solution gave a partial answer, my components got combined but in my ageing column data is missing

this output should be these combination

but i have got this

few values are reversed also like the values of age of basket 3 is exhanged with basket 4