Dashboards & Visualizations

Display Panel based on two different Inputs

ravichandra49
New Member

I have two Inputs, One is dropdown which specifies the type of File Incoming or Outgoing and another is Radio button which has three levels of SLA like Met, Warn, Breach. I want to display different panels based on different combinations of file type that can be selected using dropdown and level of SLA. How to check the values set by both tokens Change condition using match.

Labels (1)
0 Karma

niketn
Legend

@ravichandra49 you can create an independent search which can handle the values from both inputs and depending on combinations can set/unset required tokens to display.

 

Screen Shot 2020-06-23 at 11.09.56 PM.png

 

Following is a run anywhere example that you can try and confirm!

<form>
  <label>Display Panels based on inputs</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="direction" searchWhenChanged="true">
      <label>Direction</label>
      <choice value="in">Inbound</choice>
      <choice value="out">Outbound</choice>
      <default>in</default>
    </input>
    <input type="radio" token="sla" searchWhenChanged="true">
      <label>SLA</label>
      <choice value="met">Met</choice>
      <choice value="warn">Warn</choice>
      <choice value="breach">Breach</choice>
      <default>breach</default>
    </input>
  </fieldset>
  <search>
    <query>| makeresults
    | eval selection="$direction$"."_"."$sla$"
    </query>
    <done>
      <condition match="$result.selection$==&quot;in_breach&quot;">
        <set token="in_breach">true</set>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;in_warn&quot;">
        <unset token="in_breach"></unset>
        <set token="in_warn">true</set>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;in_met&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <set token="in_met">true</set>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;out_breach&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <set token="out_breach">true</set>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;out_warn&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <set token="out_warn">true</set>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;out_met&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <set token="out_met">true</set>
      </condition>
    </done>
  </search>
  <row>
    <panel depends="$in_breach$">
      <title>Inbound Breach ($in_breach$)</title>
      <table>
        <search depends="$in_breach$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$in_warn$">
      <title>Inbound Warning ($in_warn$)</title>
      <table>
        <search depends="$in_warn$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$in_met$">
      <title>Inbound Met ($in_met$)</title>
      <table>
        <search depends="$in_met$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$out_breach$">
      <title>Outbound Breach ($out_breach$)</title>
      <table>
        <search depends="$out_breach$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$out_warn$">
      <title>Outbound Warning ($out_warn$)</title>
      <table>
        <search depends="$out_warn$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$out_met$">
      <title>Outbound Met ($out_met$)</title>
      <table>
        <search depends="$out_met$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...