Hi all,
I have a dropdown field that is used to filter the results of a pivot table. Is there a way that I can show and hide a column in the pivot table?
For instance, say the token of the dropdown field is 'select_field_1'
('version' and 'daysRemaining' are columns)
Id imagine there is a conditional command where you can do if ($select_field_1|s$=certificate,show daysRemaining hide version)
Any help would be greatly appreciated!
Tabling works, but that's not enough if you need to carry along hidden values for Drilldowns. Tokens "kind of" work with the <fields> tag, but they don't seem to update when the token changes. Classic Splunk W.
@shakSplunk
Can you try the below solution?
Here based on input value we can give the fields to be dispalyed.
<form>
<label>Test Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-4h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown">
<label>Select Sourcetype</label>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index="_internal" | dedup sourcetype | table sourcetype</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<choice value="*">All</choice>
<default>*</default>
<initialValue>All</initialValue>
<change>
<condition match="$value$=="mongod" OR $value$=="scheduler"">
<set token="display_fields">| table source, sourcetype, host, date_hour, date_mday</set>
</condition>
<condition match="$value$=="splunkd" OR $value$=="splunkd_access"">
<set token="display_fields">| table source, sourcetype, host, date_minute, date_month</set>
</condition>
<condition match="$value$=="*"">
<set token="display_fields">| table source, sourcetype, host</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Fields</title>
<search>
<query>index="_internal" | dedup source, sourcetype $display_fields$</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
below solution?