Dashboards & Visualizations

Display and hide column based on dropdown value

shakSplunk
Path Finder

Hi all,

I have a dropdown field that is used to filter the results of a pivot table. Is there a way that I can show and hide a column in the pivot table?

For instance, say the token of the dropdown field is 'select_field_1'

('version' and 'daysRemaining' are columns)

Id imagine there is a conditional command where you can do if ($select_field_1|s$=certificate,show daysRemaining hide version)

Any help would be greatly appreciated!

Labels (2)
0 Karma

spunk_enthusias
Path Finder

Tabling works, but that's not enough if you need to carry along hidden values for Drilldowns. Tokens "kind of" work with the <fields> tag, but they don't seem to update when the token changes. Classic Splunk W.

0 Karma

jhanvidattani
Path Finder

@shakSplunk 

Can you try the below solution?

Here based on input value we can give the fields to be dispalyed.

<form>
  <label>Test Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="time_token" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-4h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown">
      <label>Select Sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index="_internal" | dedup  sourcetype | table sourcetype</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>All</initialValue>
      <change>
        <condition match="$value$==&quot;mongod&quot; OR $value$==&quot;scheduler&quot;">
          <set token="display_fields">| table source, sourcetype, host, date_hour, date_mday</set>
        </condition>
        <condition match="$value$==&quot;splunkd&quot; OR $value$==&quot;splunkd_access&quot;">
          <set token="display_fields">| table source, sourcetype, host, date_minute, date_month</set>
        </condition>
        <condition match="$value$==&quot;*&quot;">
          <set token="display_fields">| table source, sourcetype, host</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Fields</title>
        <search>
          <query>index="_internal" | dedup source, sourcetype $display_fields$</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

below solution?

 

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...