Accordion in Splunk?

[alex8103]

Hello,

my graphs in Spluk are becoming very many over time. I would therefore like to build a kind of accordion to be able to expand and collapse the individual areas.
Can someone please tell me how to do this?

Best regards

Alex

[bowesmana]

There are a number of ways to achieve something like this.

• Uses a tab mechanism (using Splunk input type="link") to show groups of panels
• Use a small visualisation to show a "thumbnail" and then expand the chart and remove other thumbnails when clicking on the chart

These all generally work through panel dependency and tokens to hide or show certain panels.

The tab approach simply uses a <change> element in the <input> to set and unset tokens that show or hide panels relating to that tab

      <input id="cascade_group" type="link" token="tab">
        <label>Cascade</label>
        <choice value="l1">Tab 1</choice>
        <choice value="l2">Tab 2</choice>
        <default>l1</default>
        <change>
          <condition value="l1">
            <unset token="show_l2"></unset>
            <set token="show_l1"></set>
          </condition>
          <condition value="l2">
            <unset token="show_l1"></unset>
            <set token="show_l2"></set>
          </condition>
        </change>
      </input>

Use the <row depends="$show_l1$> syntax to show rows/panels for l1 panels and the same for l2.

And this is the thumbnail approach

which if you click on the second thumbnail, expands to the chart below and removes the other thumbnails.

This is done by setting the height attribute of the chart through a token set by drilldown, e.g. something like this (but a little more complext)

<option name="height">$varietal_height$</option>

<drilldown>
  <set token="varietal_height">800</set>
  <unset... tokens for other thumbnails>
</drilldown>

Go checkout the XML reference and read about tokens and depends 

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML