Dashboards & Visualizations

Dashboard Panel - Table (Hide Results)

nitishgku
Loves-to-Learn

I have a requirement to hide the number of values displayed for each row in a table.

For example- If I have 50 values for an IP address then I want to show only 2 values, and rest should be hidden with a link “show hidden values”.

@niketn 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@nitishgku 

This dashboard example shows you how to limit the displayed results to 2, but to retain the full list, which is then used as a token via the drilldown to a new panel with the full list.

<dashboard>
  <label>test mv</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval n=mvrange(1,1801)
| mvexpand n
| eval Id=random() % 20 + 1, Value=random()
| stats values(Value) as Values by Id
| eval LimitedValues=mvindex(Values,0,1)
| sort Id</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <fields>["Id","LimitedValues"]</fields>
        <drilldown>
          <set token="id">$row.Id$</set>
          <set token="values">$row.Values$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$id$">
      <table>
        <search>
          <query>| makeresults
        | eval Id=$id$
        | eval Values=split($values|s$,",")
        | eval Count=mvcount(Values)
        | table Id, Count, Values
        | sort Values</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <unset token="id"></unset>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Hope this gives you some direction.

 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...