Dashboards & Visualizations

Customised Dashboard - How to create a dropdown to show specific panel visuals?

danielkhouri
Engager

Hello,

I've created a dashboard that is showing 15 panel charts in total. The 15 panel charts can be categorized by site - "Site-A" has 5 panel charts, "Site-B" has 5 panel charts and "Site-C" has 5 panel charts. What I'd like to do is to create a drop-down that has an option for each of the three sites and when I select each of the sites, it will only show 5 panels for that specific site.

I've created the drop-down input and given it a label called Work Sites. The token name is called work_sites. I've also created three static options called Site-A (value=site_a), Site-B (value=site_b) and Site-C (value=site_c). From some of the online searching I've done, the examples shown refer to the token value of the label, and not the actual static option value. No where in their examples did they refer to the static option value. So my question is how do I assign each panel chart to one of the sites in the drop down?

Here's what one of the queries looks like:

index=SiteA SQL
| timechart span=5min count by built_connections
| rename NULL as "conn count"

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@danielkhouri ,

You may set three different tokens for each group of sites and add a depends to the panels.

Here is a run anywhere example with 3 panels (each one for a site). Try this and let us know in case of any questions. You need to add depends to all the panels(15 in your case)

In the condition, you may use label as well in place of value

<form>
  <label>Panel Based On Token Value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>Work Sites</label>
      <choice value="site_a">Site-A</choice>
      <choice value="site_b">Site-B</choice>
      <choice value="site_c">Site_C</choice>
      <default>site_a</default>
      <change>
        <condition value="site_a">
          <set token="site_a">true</set>
          <unset token="site_b"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_b">
          <set token="site_b">true</set>
          <unset token="site_a"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_c">
          <set token="site_c">true</set>
          <unset token="site_a"></unset>
          <unset token="site_b"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$site_a$">
      <title>Site A</title>
      <chart>
        <search>
          <query>index=_*|stats count by index</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_b$">
      <title>Site B</title>
      <chart>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_c$">
      <title>Site C</title>
      <chart>
        <search>
          <query>index=_*|stats count by source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@danielkhouri ,

You may set three different tokens for each group of sites and add a depends to the panels.

Here is a run anywhere example with 3 panels (each one for a site). Try this and let us know in case of any questions. You need to add depends to all the panels(15 in your case)

In the condition, you may use label as well in place of value

<form>
  <label>Panel Based On Token Value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>Work Sites</label>
      <choice value="site_a">Site-A</choice>
      <choice value="site_b">Site-B</choice>
      <choice value="site_c">Site_C</choice>
      <default>site_a</default>
      <change>
        <condition value="site_a">
          <set token="site_a">true</set>
          <unset token="site_b"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_b">
          <set token="site_b">true</set>
          <unset token="site_a"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_c">
          <set token="site_c">true</set>
          <unset token="site_a"></unset>
          <unset token="site_b"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$site_a$">
      <title>Site A</title>
      <chart>
        <search>
          <query>index=_*|stats count by index</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_b$">
      <title>Site B</title>
      <chart>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_c$">
      <title>Site C</title>
      <chart>
        <search>
          <query>index=_*|stats count by source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Happy Splunking!

danielkhouri
Engager

Hello Renjith,

Thanks for the prompt reply, it seems to be working using the method you outlined!

Two related questions:
1. Can I add a panel chart so that it appears under two sites (SiteA and SiteB)? If so, how would you do this?
2. I've also created check boxes in the same dashboard panel. Ontop of assigning a panel to a Site (using drop down), how would I assign it also to a checkbox option (e.g. let assume I've got a check box option called "power").

0 Karma

danielkhouri
Engager

Got it working now - thanks for all your help Renjith!

0 Karma

danielkhouri
Engager

Hi Renjith,

Apologies - I should've been a little more clearer in regards to question 1. I want to create a new drop down value called "All sites" and what I'd like is to show all 15 panel visuals when I select "All sites". So this means Site-A will show up under the "Site-A" and "All Sites" drop down options.

In regards to question 2, I'll give you a quick example of what I'm trying to do. Site-A is a 5 story building. When I select Site-A from the drop down, I'd like 5 checkbox options available, one for each floor (floor-1,floor-2,.....floor-5). From here, I want to click on the relevant floor checkbox to look at the graphs relating to that floor for Site-A.

Thanks,
Daniel

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi Daniel,
No worries.

Try this run dashboard. I have set two floors for Site A. If it works for you, you can repeat the same for other sites and floors.

<form>
  <label>Panel Based On Token Value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>Work Sites</label>
      <choice value="site_a">Site-A</choice>
      <choice value="site_b">Site-B</choice>
      <choice value="site_c">Site_C</choice>
      <choice value="*">All</choice>
      <default>site_a</default>
      <change>
        <condition value="site_a">
          <set token="site_a">true</set>
          <unset token="site_b"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_b">
          <set token="site_b">true</set>
          <unset token="site_a"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_c">
          <set token="site_c">true</set>
          <unset token="site_a"></unset>
          <unset token="site_b"></unset>
        </condition>
        <condition>
          <set token="site_a">true</set>
          <set token="site_b">true</set>
          <set token="site_c">true</set>
        </condition>
      </change>
    </input>
    <input type="checkbox" token="site_floor1" depends="$site_a$">
      <label>Floors</label>
      <choice value="sitea_floor1">Floor1</choice>
      <choice value="sitea_floor2">Floor2</choice>
      <default>sitea_floor1,sitea_floor2</default>
      <initialValue>sitea_floor1,sitea_floor2</initialValue>
      <change>
        <condition value="sitea_floor1">
          <set token="sitea_floor1">true</set>
          <unset token="sitea_floor2"></unset>
        </condition>
        <condition value="sitea_floor2">
          <set token="sitea_floor2">true</set>
          <unset token="sitea_floor1"></unset>
        </condition>
        <condition value="sitea_floor1,sitea_floor2">
          <set token="sitea_floor1">true</set>
          <set token="sitea_floor2">true</set>
        </condition>
        <condition>
          <set token="sitea_floor1">true</set>
          <set token="sitea_floor2">true</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$site_a$,$sitea_floor1$">
      <title>Site A Floor 1</title>
      <chart>
        <search>
          <query>index=_*|stats count by index</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_a$,$sitea_floor2$">
      <title>Site A Floor 2</title>
      <chart>
        <search>
          <query>index=_internal|stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$site_b$">
      <title>Site B</title>
      <chart>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_c$">
      <title>Site C</title>
      <chart>
        <search>
          <query>index=_*|stats count by source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

danielkhouri
Engager

Hi Renjith,

Managed to get it the check boxes in place. I got an issue though - when I select a site and the first checkbox, it shows the panels associated for that checkbox (all well and good). When I select a second checkbox (while the first check box is still ticked), it doesn't show the panel that's meant to show for the second check box option, it's only displaying the panels from the first check box I ticked. The only way for me to view the second check box panels is to untick the first check box and then tick the second check box. Is this normal behavior?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi Daniel,
As mentioned before, check box with multiple values are tricky

Could you please copy this XML example and test it ? Its a run anywhere example. I have added 2 floors for Site A

<form>
  <label>Panel Based On Token Value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>Work Sites</label>
      <choice value="site_a">Site-A</choice>
      <choice value="site_b">Site-B</choice>
      <choice value="site_c">Site_C</choice>
      <choice value="*">All</choice>
      <default>site_a</default>
      <change>
        <condition value="site_a">
          <set token="site_a">true</set>
          <unset token="site_b"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_b">
          <set token="site_b">true</set>
          <unset token="site_a"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_c">
          <set token="site_c">true</set>
          <unset token="site_a"></unset>
          <unset token="site_b"></unset>
        </condition>
        <condition>
          <set token="site_a">true</set>
          <set token="site_b">true</set>
          <set token="site_c">true</set>
        </condition>
      </change>
    </input>
    <input type="checkbox" token="site_floor1" depends="$site_a$">
      <label>Floors</label>
      <choice value="sitea_floor1">Floor1</choice>
      <choice value="sitea_floor2">Floor2</choice>
      <initialValue>sitea_floor1,sitea_floor2</initialValue>
      <change>
        <condition value="sitea_floor1">
          <set token="sitea_floor1">true</set>
          <unset token="sitea_floor2"></unset>
        </condition>
        <condition value="sitea_floor2">
          <set token="sitea_floor2">true</set>
          <unset token="sitea_floor1"></unset>
        </condition>
        <condition value="sitea_floor1,sitea_floor2">
          <set token="sitea_floor1">true</set>
          <set token="sitea_floor2">true</set>
        </condition>
        <condition>
          <unset token="sitea_floor1"></unset>
          <unset token="sitea_floor2"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$site_a$,$sitea_floor1$">
      <title>Site A Floor 1</title>
      <chart>
        <search>
          <query>| makeresults count=3| streamstats count| eval site="SITE_A".count| stats count by site</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel depends="$site_a$,$sitea_floor2$">
      <title>Site A Floor 2</title>
      <chart>
        <search>
          <query>| makeresults count=6| streamstats count| eval site="SITE_A".count| stats count by site</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$site_b$">
      <title>Site B</title>
      <chart>
        <search>
          <query>| makeresults count=9| streamstats count| eval site="SITE_B".count| stats count by site</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel depends="$site_c$">
      <title>Site C</title>
      <chart>
        <search>
          <query>| makeresults count=12| streamstats count| eval site="SITE_C".count| stats count by site</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@danielkhouri ,

  1. Yes. You may create another token and set it for both A & B

Here is the extended example. The common panel will display with both Site A and B

<form>
  <label>Panel Based On Token Value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>Work Sites</label>
      <choice value="site_a">Site-A</choice>
      <choice value="site_b">Site-B</choice>
      <choice value="site_c">Site_C</choice>
      <default>site_a</default>
      <change>
        <condition value="site_a">
          <set token="site_a">true</set>
          <set token="common_for_a_and_b">true</set>
          <unset token="site_b"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_b">
          <set token="site_b">true</set>
          <set token="common_for_a_and_b">true</set>
          <unset token="site_a"></unset>
          <unset token="site_c"></unset>
        </condition>
        <condition value="site_c">
          <set token="site_c">true</set>
          <unset token="site_a"></unset>
          <unset token="site_b"></unset>
          <unset token="common_for_a_and_b"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$site_a$">
      <title>Site A</title>
      <chart>
        <search>
          <query>index=_*|stats count by index</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_b$">
      <title>Site B</title>
      <chart>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$site_c$">
      <title>Site C</title>
      <chart>
        <search>
          <query>index=_*|stats count by source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$common_for_a_and_b$">
      <title>Common Site</title>
      <chart>
        <search>
          <query>index=_internal
| stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
  1. It's tricky to use checkbox for setting and un-setting token multiple values because they don't work quite well. If its a single checkbox , then based on the select/deselect , we can set token
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...