Dashboards & Visualizations

Dashboard conditional search not working

nareshinsvu
Builder

Hello experts,

I am trying to dynamically change my dashboard view based on 3 dropdown inputs. All the time, my show_tab1 results are hidden even if the condition matches. Any help to tweak the code is appreciated.

  <row>
<panel>
  <table depends="$hide_table$">
    <search>
                <query> | from datamodel:"0DP_T_common" | search C_Category=$selected_cat$ C_endpoint="$selected_endpoint$" C_Response=$selected_response$ |  table C_Day C_StartTime C_Category C_endpoint C_Response duration</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
      <done>
     <condition match="$result.selected_cat$=Categ_1 AND $result.selected_endpoint$=prime AND $result.selected_response$=00">
      <unset token="hide_table"></unset>
      <set token="show_tab1">true</set>
     </condition>
     <condition>
       <set token="hide_table">true</set>
       <unset token="show_tab1"></unset>
     </condition>
      </done>
     </search>
  </table>
  <table depends="$show_tab1$">
    <search>
      <query> | from datamodel:"0DP_T_selected" | search C_Category=$selected_cat$ C_endpoint="$selected_endpoint$" C_Response=$selected_response$ |  table C_Day C_StartTime C_Category C_endpoint C_Response duration</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
     </search>
   </table>
</panel>
Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@nareshinsvu ,

You may use depends and rejects instead of using two tokens. But two tokens should work as well.

In your condition , you are validating $result.selected_cat$ , $result.selected_endpoint$ and $result.selected_response$ but those are not part of your result set , instead the fields are C_Category , C_endpoint and C_Response. So replace the token names with the fields from the search result.

i.e. try

<condition match="$result.C_Category$=Categ_1 AND $result.C_endpoint$=prime AND $result.C_Response$=00">
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

vnravikumar
Champion

Hi @nareshinsvu

Are you want to show/hide panel based on three dropdowns or based on query result?

0 Karma

nareshinsvu
Builder

@vnravikumar - I wanted different searches for different set of Dropdowns actually.

0 Karma

nareshinsvu
Builder

@vnravikumar - Any further help is much appreciated.

0 Karma

renjith_nair
Legend

@nareshinsvu ,

You may use depends and rejects instead of using two tokens. But two tokens should work as well.

In your condition , you are validating $result.selected_cat$ , $result.selected_endpoint$ and $result.selected_response$ but those are not part of your result set , instead the fields are C_Category , C_endpoint and C_Response. So replace the token names with the fields from the search result.

i.e. try

<condition match="$result.C_Category$=Categ_1 AND $result.C_endpoint$=prime AND $result.C_Response$=00">
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

nareshinsvu
Builder

Hi @renjith.nair ,

No Luck. I am getting the same result even after changing the condition as you mentioned.

Thanks,
Naresh

0 Karma

renjith_nair
Legend

@nareshinsvu ,

Put the text in quotes

ie.

<condition match='$result.C_Category$="Categ_1" AND $result.C_endpoint$="prime" AND $result.C_Response$="00"'>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Working example

<form>
  <label>Token settings</label>
  <fieldset submitButton="false">
    <input type="text" token="category">
      <label>Category</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table depends="$hide_table$">
        <title>First Table</title>
        <search>
          <query>|makeresults|eval C_Category="$category$", C_endpoint="prime", C_Response="00" |  table C_Category C_endpoint C_Response duration</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$result.C_Category$=&quot;Categ_1&quot; AND $result.C_endpoint$=&quot;prime&quot; AND $result.C_Response$=&quot;00&quot;">
              <unset token="hide_table"></unset>
              <set token="show_tab1">true</set>
            </condition>
            <condition>
              <set token="hide_table">true</set>
              <unset token="show_tab1"></unset>
            </condition>
          </done>
        </search>
      </table>
      <table depends="$show_tab1$">
        <title>Second table</title>
        <search>
          <query>|makeresults|eval C_Category="Categ_2", C_endpoint="prime1", C_Response="00" |  table C_Category C_endpoint C_Response duration</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

Any input other than Categ_1 will result in first table and second table only when Categ_1 in text box

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

nareshinsvu
Builder

Awesome @renjith.nair . It works. Is there alternate way to drive this using the dropdown values rather than the search query values?

Also you mentioned about depends and rejects. How to use that approach?

0 Karma

nareshinsvu
Builder

@renjith.nair - Any further help is much appreciated. Looking for the conditional search on dropdown values rather than the search results.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...