topic Re: Panel based on dropdown value in Splunk Search

Panel based on dropdown value

Muthu_Vinith — Thu, 07 Mar 2024 13:47:17 GMT

Hi Experts,

I am encountering an issue with using filter tokens in specific row on my dashboard. I have two filters named ABC and DEF, tokens represented for ABC is $abc$ and DEF is $def$.

I want to pass these tokens only to one specific row, while for others, I want to reject them.

For the rows where i need to pass the tokens, I've used the following syntax: <row depends="$abc$ $def$"></row>

For the row where i don't want to use the token, I've used the following syntax; <row rejects="$abc$ $def$"></row>.

However when i use the rejects condition, the rows are hidden. I want these rows to still be visible.

Could someone please advise on how to resolve this issue? I would appreciate every help. Thank you in advance!

Re: Panel based on dropdown value

ITWhisperer — Thu, 07 Mar 2024 15:20:54 GMT

Just use one token - if necessary, use the <change> construct in your filters to set/unset a third token GHI $ghi$ based on whether $abc$ and/or $def$ are set

Re: Panel based on dropdown value

Muthu_Vinith — Thu, 07 Mar 2024 15:32:18 GMT

So in that case we don't want to use reject condition in the row right? @ITWhisperer

Could you please share sample query for reference?

Re: Panel based on dropdown value

ITWhisperer — Thu, 07 Mar 2024 16:26:52 GMT

Please share your current dashboard source (or at least a cutdown version showing your filters, rows and panels)