Dashboards & Visualizations

Dashboard Panel - Table (Hide Results)

nitishgku
Loves-to-Learn

I have a requirement to hide the number of values displayed for each row in a table.

For example- If I have 50 values for an IP address then I want to show only 2 values, and rest should be hidden with a link “show hidden values”.

@niketn 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@nitishgku 

This dashboard example shows you how to limit the displayed results to 2, but to retain the full list, which is then used as a token via the drilldown to a new panel with the full list.

<dashboard>
  <label>test mv</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval n=mvrange(1,1801)
| mvexpand n
| eval Id=random() % 20 + 1, Value=random()
| stats values(Value) as Values by Id
| eval LimitedValues=mvindex(Values,0,1)
| sort Id</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <fields>["Id","LimitedValues"]</fields>
        <drilldown>
          <set token="id">$row.Id$</set>
          <set token="values">$row.Values$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$id$">
      <table>
        <search>
          <query>| makeresults
        | eval Id=$id$
        | eval Values=split($values|s$,",")
        | eval Count=mvcount(Values)
        | table Id, Count, Values
        | sort Values</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <unset token="id"></unset>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Hope this gives you some direction.

 

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...