Splunk Search

How to run search only for shown panels?

naty
Path Finder

Hi,

i have a dashboard with several panels.
i have used the "depends" option for every panel to see only those that i need.

what i have noticed is even though i have this option, still all the panels would start the search as soon as the page loads and not when only shown.

meaning, when i open the dashboard i see nothing.
i'm inputting some data for tokens (interval, time, etc).
then i choose the panels i would like to show.
for each panel i have used the depends and rejects options to see only those that matter to that subject.
i have noticed that after inputting all the data needed, all the panels would make their search, no matter if the depends is on them.

my goal is that only that shown panels would start the search and show their output.
we are using Splunk 6.5.1

How can it be done?

Thank you!

Tags (1)
0 Karma

naty
Path Finder

i found a workaround for this.
i'm initializing the tokens at the page load, so no panel is shown for the start.
this is how i achieved it:

<form>
    <init>
        <unset token="a"></unset>
        <unset token="b"></unset>
        <unset token="c"></unset>
        ...

      </init>
</form>

in the tag you can initialize many things, here is a link to the tag description:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

0 Karma

somesoni2
Revered Legend

Best option would be to include the depends token that you used for panel in the panel search, so that searches will not run untill that token is set (and thus panel is visible). E.g. If you're setting a token say $showPanel1$ with value say "Y", then in the base search (first portion) of the panel search, add a condition "$showPanel1$"="Y".

0 Karma

naty
Path Finder

can you give an example?
if i got it right, you mean something like this:
index=myind source=mysrc "$showPanel1$"="Y" | ...
but doesn't interfere with the search? i'm basically saying to splunk to search for event with showPanel=Y

0 Karma

somesoni2
Revered Legend

It won't. When the token value is evaluated, your search will look like this and should always work.

index=myind source=mysrc "Y"="Y" | ...

Another (better IMO) option you could do is to set value of $showPanel1$ as 1, then your search would look like this

index=myind source=mysrc $showPanel1=1 | ...

Upon evaluation, results in 1=1 which is always true.

index=myind source=mysrc 1=1 | ...
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...