Chnaging panel query based on token

[BearMormont]

I have a dashboard with a base search that feeds a simple panel like below. Is it possible to change the <query> based on a token? For example, let's say the token $tknIncludeField2$ is set to false. I would want the query instead to read | stats list(Field1) by Field3

Is that possible?

<panel>
  <title>My Awesome Table</title>
  <table>
    <search base="base">
            <query>
                | stats list(Field1), list(Field2) by Field3
            </query>
    </search>
    <option name="count">10</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
</panel>

Thanks!

[damiensurat · Accepted solution]

you sure can, what you would want to do is set or unset the token based on the condition.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/tokens

notice in the example below the logic to set and unset a token.

   <search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>`enter code here`
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>

so in your situation:

          <condition match=$tknIncludeField2$== 0">
               <set token="field2">"list(Field1)"</set>
           </condition>
           <condition>
               <unset token="field2"/>
           </condition>

But it may be easier to just provide a multiselect form input and then use the values to populate the selectable fields. Here's an example that should do exactly as you are requesting based on your sample (of course you will still need the base query):

 <form>
   <label>a</label>
   <fieldset submitButton="false">
     <input type="multiselect" token="listFieldsChoice" searchWhenChanged="true">
       <label>Field Filter</label>
       <choice value="field1">Field1</choice>
       <choice value="field2">Field2</choice>
       <choice value="field3">Field3</choice>
       <valuePrefix>list(</valuePrefix>
       <valueSuffix>)</valueSuffix>
       <delimiter>, </delimiter>
     </input>
   </fieldset>
   <row>
       <panel>
           <title>My Awesome Table</title>
           <table>
               <search base="base">
               <query>
                 | stats $listFieldsChoice$ by Field3
               </query>
             </search>
             <option name="count">10</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">none</option>
             <option name="percentagesRow">false</option>
             <option name="refresh.display">progressbar</option>
             <option name="rowNumbers">false</option>
             <option name="totalsRow">false</option>
             <option name="wrap">true</option>
         </table>
     </panel>
  </row>
</form>

[BearMormont]

You rocked my face off!

This is EXACTLY what I needed!

[damiensurat]

Haha. Great to hear BearMormont! Happy Splunking!