Different Tokens to Different values of Same Field

[akhil36109]

I have a table like this

TIME_INTERVAL --- fieldname

Daily
Monthly

so what i want to achieve is when someone clicks "Daily" it shd got panelA and if someone clicks "Monthly" it should go to panelB

is that possible??

The reason I want this is I am trying to row highlighting

Time_interval MissingCount

Daily 24
Daily 1
Monthly 1

I want diff colors for diff ranges of diff values of Time_interval
Let me explain,

when Time_interval=Daily missingcount=24 should be red color and missingcount=1 shd be gree color
whereas if Time_interval=Monthly missingcount=1 is a RED color

so how to do it?/
Thank you very much

[jconger]

It sounds like there are 2 questions here:

1. How to show different panels based on a field value in a table row. You can use a <drilldown> to conditionally set a token for this use case. Then, use the token to show/hide a dashboard element.
2. How to highlight a table row based on certain conditions. You can use a custom row renderer for this use case. See the "Table Cell Highlighting" example in the example app that @woodcock mentioned.

Here is a run anywhere example for the token setting:

<dashboard>
  <label>Different Tokens to Different values of Same Field</label>
  <row>
    <panel>
      <title>Table</title>
      <table>
        <search>
          <query>| makeresults count=3 
| streamstats count AS count 
| eval TIME_INTERVAL=case(count=1,"Daily", count=2,"Daily", count=3,"Monthly") 
| eval fieldname=case(count=1,24, count=2,1, count=3,1) 
| table TIME_INTERVAL fieldname</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <condition match="$click.value2$==&quot;Daily&quot;">
            <set token="show_panel_a">true</set>
            <unset token="show_panel_b"></unset>
          </condition>
          <condition match="$click.value2$==&quot;Monthly&quot;">
            <set token="show_panel_b">true</set>
            <unset token="show_panel_a"></unset>
          </condition>
          <condition>
            <unset token="show_panel_a"></unset>
            <unset token="show_panel_b"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$show_panel_a$">
      <title>This is panel A</title>
      <table>
        <search>
          <query>
            | makeresults count=2
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$show_panel_b$">
      <title>This is panel B</title>
      <table>
        <search>
          <query>
            | makeresults count=1
          </query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

[niketn]

@akhil36109, can you try the following run anywhere example? It creates two panels Panel A and Panel B and displays Panels for Daily and Monthly respectively. However, to run only search for one panel you might need to use JavaScript. If JavaScript is required, which you are using for Table Row Color, maybe you can handle color based on TIME_INTERVAL in a single panel. Would it be possible for you to share Table Coloring JavaScript for Daily and Monthly Panels so that we can assist?

<dashboard>
  <label>Panel A and Panel B based on Time Interval</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval data="TIME_INTERVAL=Daily,count=20;TIME_INTERVAL=Monthly,count=500"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| table TIME_INTERVAL count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="tokClickedTimeInterval">$row.TIME_INTERVAL$</set>
          <set token="tokClickedCount">$row.count$</set>
          <eval token="showPanelDaily">case($row.TIME_INTERVAL$=="Daily","true")</eval>
          <eval token="showPanelMonthly">case($row.TIME_INTERVAL$=="Monthly","true")</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tokClickedTimeInterval- $tokClickedTimeInterval$ , tokClickedCount- $tokClickedCount$ , showPanelDaily- $showPanelDaily$ , showPanelMonthly- $showPanelMonthly$
      </html>
    </panel>
  </row>
  <row>
    <panel depends="$showPanelDaily$">
      <title>Panel A</title>
      <table>
        <search>
          <query>| makeresults 
| fields - _time 
| eval TIME_INTERVAL="$tokClickedTimeInterval$",count=$tokClickedCount$</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$showPanelMonthly$">
      <title>Panel B</title>
      <table>
        <search>
          <query>| makeresults
| fields - _time
| eval TIME_INTERVAL="$tokClickedTimeInterval$",eval count=$tokClickedCount$</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

[woodcock]

I do not get your situation but I am confident that it is covered by the examples that you will find in this app. Download it and take a look around and clone what you need:

https://splunkbase.splunk.com/app/1603/