Dashboards & Visualizations

Display Panel based on two different Inputs

ravichandra49
New Member

I have two Inputs, One is dropdown which specifies the type of File Incoming or Outgoing and another is Radio button which has three levels of SLA like Met, Warn, Breach. I want to display different panels based on different combinations of file type that can be selected using dropdown and level of SLA. How to check the values set by both tokens Change condition using match.

Labels (1)
0 Karma

niketn
Legend

@ravichandra49 you can create an independent search which can handle the values from both inputs and depending on combinations can set/unset required tokens to display.

 

Screen Shot 2020-06-23 at 11.09.56 PM.png

 

Following is a run anywhere example that you can try and confirm!

<form>
  <label>Display Panels based on inputs</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="direction" searchWhenChanged="true">
      <label>Direction</label>
      <choice value="in">Inbound</choice>
      <choice value="out">Outbound</choice>
      <default>in</default>
    </input>
    <input type="radio" token="sla" searchWhenChanged="true">
      <label>SLA</label>
      <choice value="met">Met</choice>
      <choice value="warn">Warn</choice>
      <choice value="breach">Breach</choice>
      <default>breach</default>
    </input>
  </fieldset>
  <search>
    <query>| makeresults
    | eval selection="$direction$"."_"."$sla$"
    </query>
    <done>
      <condition match="$result.selection$==&quot;in_breach&quot;">
        <set token="in_breach">true</set>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;in_warn&quot;">
        <unset token="in_breach"></unset>
        <set token="in_warn">true</set>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;in_met&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <set token="in_met">true</set>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;out_breach&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <set token="out_breach">true</set>
        <unset token="out_warn"></unset>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;out_warn&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <set token="out_warn">true</set>
        <unset token="out_met"></unset>
      </condition>
      <condition match="$result.selection$==&quot;out_met&quot;">
        <unset token="in_breach"></unset>
        <unset token="in_warn"></unset>
        <unset token="in_met"></unset>
        <unset token="out_breach"></unset>
        <unset token="out_warn"></unset>
        <set token="out_met">true</set>
      </condition>
    </done>
  </search>
  <row>
    <panel depends="$in_breach$">
      <title>Inbound Breach ($in_breach$)</title>
      <table>
        <search depends="$in_breach$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$in_warn$">
      <title>Inbound Warning ($in_warn$)</title>
      <table>
        <search depends="$in_warn$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$in_met$">
      <title>Inbound Met ($in_met$)</title>
      <table>
        <search depends="$in_met$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$out_breach$">
      <title>Outbound Breach ($out_breach$)</title>
      <table>
        <search depends="$out_breach$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$out_warn$">
      <title>Outbound Warning ($out_warn$)</title>
      <table>
        <search depends="$out_warn$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$out_met$">
      <title>Outbound Met ($out_met$)</title>
      <table>
        <search depends="$out_met$">
          <query>| makeresults
          | fields - _time
          | eval Direction="$direction$",SLA="$sla$"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...