Dashboards & Visualizations

Dropdown - set token when no selection

Shaw
Explorer

Hello guys,

I need a help with a dropdown, basically i have a dropdown based on a previous one that returns me some choice about hostnames.

Based on this hostname i need to show some panels, but i would like that  till the user doesnt's choose one option from the dropdown nothing appear in the dasboard.

But my token assume the "$label$" value so the depends attribute show alway what i'm trying to hide. Below the code:

<input depends="$switch_type$" type="dropdown" searchWhenChanged="true" token="device_name">
<label>Switch Name</label>
<fieldForLabel>switch</fieldForLabel>
<fieldForValue>hostname</fieldForValue>
<search>
<query>"my query "</query>
</search>
<change>
<set token="switch">$label$</set>
</change>

I would like that till the user doesnt select something from the dropdwon the token $switch$ is false or unset, in order to be able use it on depends condition...
The value  that token can assume are not fixed so i can  not use custom condition..

Thanks for the help


Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<input depends="$switch_type$" type="dropdown" searchWhenChanged="true" token="device_name">
<label>Switch Name</label>
<fieldForLabel>switch</fieldForLabel>
<fieldForValue>hostname</fieldForValue>
<search>
<query>"retrieve list off all switch name" </query>
</search>
<change>
<eval token="switch">if(mvcount($form.device_name$)&gt;0,$label$,null())</eval>
</change>
</input>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Can you unset the switch token as part of the change in the previous one?

<change>
<unset token="switch"/>
</change>
0 Karma

Shaw
Explorer

if you intend the previos dropdwon it doesn't affect the behavior.

The first dropdown permit to choose between: switch, router, plc ecc
The second dropdown permit  to choose based on devyce type selected  the device names (that i list using a search).

My token based on the second dropdown can assume the following values:
$switch$ = any names that the user click on the list shown
$switch$ = $label$ (if nothing is selected)

In a panel if use depends ="$switch$", no matter what it will always appear because the token has always a value.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct - depends works based on the presence or absence of the token not the value of the token

So what I was suggesting is that, in the first dropdown, you unset the token being used by the panels in their depends until a choice is made in the second dropdown. That way, when a new type is selected (switch, router, etc.) the panels disappear until the actual switch/router is selected from the list.

0 Karma

Shaw
Explorer

mmm.. i'm not understanding how to make that condition in the first dropdown..
should i have a new token only for the visualizations? 

Suppose my first dropdown is:

<input type="dropdown" token="device_type" searchWhenChanged="true">
<label>Device Type</label>
<choice value="switch">Switch</choice>
<choice value="router">Router</choice>
<change>


<condition label="Switch">
<set token="switch_type">true</set>
<unset token="router_type"></unset>
</condition>


<condition label="Router">
<unset token="switch_type"></unset>
<set token="router_type">true</set>
</condition>

the second dropdown:

<input depends="$switch_type$" type="dropdown" searchWhenChanged="true" token="device_name">
<label>Switch Name</label>
<fieldForLabel>switch</fieldForLabel>
<fieldForValue>hostname</fieldForValue>
<search>
<query>"retrieve list off all switch name" </query>
</search>
<change>
<set token="switch">$label$</set>
</change>
</input>

my panel
<panel depends=???>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<input type="dropdown" token="device_type" searchWhenChanged="true">
<label>Device Type</label>
<choice value="switch">Switch</choice>
<choice value="router">Router</choice>
<change>


<condition label="Switch">
<set token="switch_type">true</set>
<unset token="router_type"></unset>
<unset token="switch"></unset>
<unset token="router"></unset>
</condition>


<condition label="Router">
<unset token="switch_type"></unset>
<set token="router_type">true</set>
<unset token="switch"></unset>
<unset token="router"></unset>
</condition>

the second dropdown:

<input depends="$switch_type$" type="dropdown" searchWhenChanged="true" token="device_name">
<label>Switch Name</label>
<fieldForLabel>switch</fieldForLabel>
<fieldForValue>hostname</fieldForValue>
<search>
<query>"retrieve list off all switch name" </query>
</search>
<change>
<set token="switch">$label$</set>
</change>
</input>

Similarly for router_type dropdown

Then in panels

<panel depends="$switch$">

and similarly for router panel

0 Karma

Shaw
Explorer

mmm in the moment i choose the device type  in the first dropdown,
the token  $switch$ assume the value $label$  even with your integration..


0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<input depends="$switch_type$" type="dropdown" searchWhenChanged="true" token="device_name">
<label>Switch Name</label>
<fieldForLabel>switch</fieldForLabel>
<fieldForValue>hostname</fieldForValue>
<search>
<query>"retrieve list off all switch name" </query>
</search>
<change>
<eval token="switch">if(mvcount($form.device_name$)&gt;0,$label$,null())</eval>
</change>
</input>

Shaw
Explorer

Hi,


I had to change the null() with a false but then it does what i need!!

Thank you so much!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...