Dashboards & Visualizations

Display different panel depends on selected name in the chart

krusovice
Path Finder

Hello there,

I've a requirement to design a panel depends on the clicked name in the chart.

For example my chart is to display the count of the country for 3 type of requests (panel1). Depends on the type of request, panel2 should display a table, the format of table for 3 type of requests are difference. Therefore desired output should be click on requestA - display tableA, click on requestB - display tableB and etc.

How can I achieve this requirement? Thanks.

Tags (1)
0 Karma
1 Solution

niketn
Legend

Following is a run anywhere dashboard based on Splunk's _internal log based on sample screenshot and code shared.
The second drilldown with condition states before is working as expected.

<condition match="$clicked_request$==&quot;RequestA&quot;">

alt text

<form>
  <label>Table based on Pie Chart Click</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label>Select Time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" component!="Metrics"
| timechart span=1h count by log_level
| rename INFO as "RequestA"
| rename ERROR as "RequestB"
| rename WARN as "RequestC"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="clicked_request">$click.name2$</set>
          <set token="clicked_time">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
    <panel depends="$show_panel$">
      <chart>
        <title>$clicked_request$</title>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" component!="Metrics"
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <!-- RequestA -->
          <condition match="$clicked_request$==&quot;RequestA&quot;">
            <set token="Apanel">RequestA</set>
            <unset token="Bpanel"></unset>
            <unset token="Cpanel"></unset>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <!-- RequestB -->
          <condition match="$clicked_request$==&quot;RequestB&quot;">
            <unset token="Apanel"></unset>
            <set token="Bpanel">RequestB</set>
            <unset token="Cpanel"></unset>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <!-- RequestC -->
          <condition match="$clicked_request$==&quot;RequestC&quot;">
            <unset token="Apanel"></unset>
            <unset token="Bpanel"></unset>
            <set token="Cpanel">RequestC</set>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <condition>
            <!-- DO NOTHING -->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$Apanel$">
        <title>$Apanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$" component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
      <chart depends="$Bpanel$">
        <title>$Bpanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$"  component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
      <chart depends="$Cpanel$">
        <title>$Cpanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$"  component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a run anywhere dashboard based on Splunk's _internal log based on sample screenshot and code shared.
The second drilldown with condition states before is working as expected.

<condition match="$clicked_request$==&quot;RequestA&quot;">

alt text

<form>
  <label>Table based on Pie Chart Click</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label>Select Time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" component!="Metrics"
| timechart span=1h count by log_level
| rename INFO as "RequestA"
| rename ERROR as "RequestB"
| rename WARN as "RequestC"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="clicked_request">$click.name2$</set>
          <set token="clicked_time">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
    <panel depends="$show_panel$">
      <chart>
        <title>$clicked_request$</title>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" component!="Metrics"
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <!-- RequestA -->
          <condition match="$clicked_request$==&quot;RequestA&quot;">
            <set token="Apanel">RequestA</set>
            <unset token="Bpanel"></unset>
            <unset token="Cpanel"></unset>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <!-- RequestB -->
          <condition match="$clicked_request$==&quot;RequestB&quot;">
            <unset token="Apanel"></unset>
            <set token="Bpanel">RequestB</set>
            <unset token="Cpanel"></unset>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <!-- RequestC -->
          <condition match="$clicked_request$==&quot;RequestC&quot;">
            <unset token="Apanel"></unset>
            <unset token="Bpanel"></unset>
            <set token="Cpanel">RequestC</set>
            <set token="clicked_country">$click.value$</set>
          </condition>
          <condition>
            <!-- DO NOTHING -->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$Apanel$">
        <title>$Apanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$" component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
      <chart depends="$Bpanel$">
        <title>$Bpanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$"  component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
      <chart depends="$Cpanel$">
        <title>$Cpanel$ Table - $clicked_country$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$clicked_country$"  component!="Metrics"
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

krusovice
Path Finder

Thank you @niketnilay for the guidance and help. I was in impression that

the "&quot;" is equivalent to " ' " in xml.

It is working great as expected result now.

0 Karma

niketn
Legend

@krusovice, you should read Splunk documentation about predefined drilldown tokens for chart to understand which one to use under what scenario. Usually, $click.name$ is the first column (if you consider data in tabular format) or x-axis (if it is in xy chart). Similarly $click.value$ is the clicked value in the first column or x-axis. Then $click.name2$ is the second column or y-axis with its corresponding value as $click.value2$. In case Time is being depicted in the chart, it is usually the first column/x-axis so the field with volume depicted over time is y-axis or second column.

With this above understanding you should

    <drilldown>
      <condition match="$click.value$==&quot;RequestA&quot;">
        <set token="tokShowRequestA">RequestA</set>
        <unset token="tokShowRequestB"></unset>
      </condition>
      <!-- Else Condition always hit for RequestB-->
      <condition>
        <unset token="tokShowRequestA"></unset>
        <set token="tokShowRequestB">RequestB</set>
      </condition>
    </drilldown>

PS: While you are using depends attribute for showing or hiding the panels. You should ensure that you use the same token in the query also, so that it keeps waiting for input and does not run for the panel which is not being displayed.

alt text

Following is a run anywhere example based on Splunk's _internal index which displays Warning or Error table based on clicking of Pie Slice:

 <form>
  <label>Table based on Pie Chart Click</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label>Select Time</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="ERROR" OR log_level="WARN"
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <set token="tokShowWarn">WARN</set>
            <unset token="tokShowError"></unset>
          </condition>
          <!-- Else Condition always hit for ERROR-->
          <condition>
            <unset token="tokShowWarn"></unset>
            <set token="tokShowError">ERROR</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$tokShowWarn$">
        <title>Warning Table</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokShowWarn$" component=*
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
      <table depends="$tokShowError$">
        <title>Error Table</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokShowError$" component=*
| timechart count by component limit=10 useother=f</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

krusovice
Path Finder

Hi @niketn,

Thanks for the detailed explanation. I've a difficulty as the token to be conditionally matched is not from the panel itself. I pasted partial of the query for 2 panels as below.

<form>
  <label>DAILY REPORT</label>
  <fieldset autoRun="false" submitButton="false">
    <input type="time" token="date">
      <label>DATE</label>
      <default>
        <earliest>@y</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>DAILY VIEW based on Request A B C</title>
      <chart>
        <search>
          <query>index=* 
| rex field=_raw max_match=0 "RequestA\s\-\sCountry\:\s(?&lt;acountry&gt;[\w+]+)" 
| rex field=_raw max_match=0 "RequestB\s\-\sCountry\:\s(?&lt;bcountry&gt;[\w+]+)"
| rex field=_raw max_match=0 "RequestC\s\-\sCountry\:\s(?&lt;ccountry&gt;[\w+]+)"
| stats count(acountry) as "Request A", count(bcountry) as "Request B", count(ccountry) as "RequestC" by date_hour
| sort date_hour</query>
          <earliest>$date.earliest$</earliest>
          <latest>$date.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="clicked_request">$click.name2$</set>
          <set token="clicked_time">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$show_panel$">
      <title>Country count based on $clicked_request$</title>
      <chart>
        <search>
          <query>index=* date_hour="$clicked_time$"
| rex field=_raw max_match=0 "$clicked_request$.*Country\:\s(?&lt;country&gt;[^\s]+)"
| chart count(date_hour) by country</query>
          <earliest>$date.earliest$</earliest>
          <latest>$date.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">none</option>
        <drilldown>
          <condition match="$click.value$=='RequestA'">
            <set token="Apanel">RequestA</set>
            <set token="clicked_country">$click.value$</set>
            <unset token="Bpanel"></unset>
          </condition>
          <!-- Else Condition always hit for RequestB-->
          <condition>
            <unset token="Apanel"></unset>
            <set token="Bpanel">"RequestB"</set>
            <set token="clicked_country">$click.value$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$Apanel$">

    ....
    ....
    ....

As you can see, clicked_request is from the first panel to display the total request based on date_hour. Once it is clicked, the next panel then will show the country count of that request. The challenge is for the third panel - which is a table with 2 input types (dropdown), and display the details of request A/B/C (based on clicked_request from first panel). How can I pass the value from panel 1 or is there better way to achieve this?

Your help is very much appreciated. Thank you in advance.

0 Karma

niketn
Legend

@krusovice would it be possible for you to post a screenshot of your current dashboard? You can mock or anonymize sensitive data. It is difficult to understand the code without sample data which will be displayed in each panel.

In the second panel for Country count based on ..., will you have requestA and requestB as pie slices? Or will it be country names?

If country names are going to be your pie slices, you should try the following <condition> for the <drilldown>:

       <condition match="$clicked_request$==&quot;RequestA&quot;">

If this does not work do paste a screenshot ( you can use image sharing site like imgur and paste the link in comment using Image <img> button or Ctrl+G.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

krusovice
Path Finder

Hi @niketnilay,

Thanks for the reply.

I've uploaded the dashboard image to https://imgur.com/izRwRbd

I've tried both of these 2 condition match setting but it is not working.

 <condition match="$clicked_request$=='RequestA'">

<condition match="match($clicked_request$,'RequestA')">

Thanks for taking a look to my problem.

0 Karma

niketn
Legend

I think request was to use &quot; not '.

<condition match="$clicked_request$==&quot;RequestA&quot;">
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

krusovice
Path Finder

Hi @deepashri,

Thanks for the reply.

I've reviewed the codes provided, it is mainly for the input source either from dropdown or bullet selection. My main panel(panel1) which showing request type is from the regex and it is showing as pie chart. The token set for this panel1 is

 <set token="clicked_request">$click.name2$</set>

How can I set the condition of the next panel based on the $click.name2$?

0 Karma

deepashri_123
Motivator

So in the next panel you have to add filter as $clicked_request$ that should help!!

0 Karma

krusovice
Path Finder

That's the exact question, how to set filter for the panel? I cannot use below setting but would like to achieve similar result.

<panel depends="$clicked_request$" = "RequestA">
0 Karma

deepashri_123
Motivator

Depending on the request, your search query for the second panel should have filter.
Something link dis:
index=* request=$clicked_request$ | query.
So when in the first panel request is selected , the second panel will run the query with the request filter and will display result for that filter

And in ur xml it should just be

 <panel depends="$clicked_request$">

Assuming request is the only filter and the query after that is common to all panels.

0 Karma

krusovice
Path Finder

Thanks, the query after the panel1 is based on selection from the chart (RequestA displays tableA, RequestB displays tableB). Both tables are displaying different data. Just wondering how should I hide the panel for tableB if the selection received is requestA?

0 Karma

deepashri_123
Motivator

I am not sure if this will work, but you can try this:
You can refer this link below :
https://answers.splunk.com/answers/378092/how-to-hide-panels-based-on-a-search-condition.html

And try condition match.

0 Karma

krusovice
Path Finder

I found a link:
https://answers.splunk.com/answers/400053/condition-match-and-set-token-in-drilldown-not-wor-1.html

Tried to form similar query but the next panel (panel_a or panel_b) is not displaying but it is showing the search dashboard with query in panel_a/panel_b. I really need some expertise advice here.

        <drilldown>
            <condition match="'click.name2' == 'RequestA'">
                    <set token="panel_a">true</set>
                    <unset token="panel_b"></unset>
                </condition>
            <condition match="'click.name2' == 'RequestB'">
                    <set token="panel_b">true</set>
                    <unset token="panel_a"></unset>
                </condition>
            </drilldown>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...