Dashboards & Visualizations

Easy way to hide annotations based on token?

aohls
Contributor

I had annotations I wanted to control with a Yes or No dropdown. It mostly works, unsetting the token doesn't seem to clear the token correctly as the annotations remain. 

 

 

<search depends=$showToken$ id="base">
<query>search.....</query>
</search>
...
<input type="dropdown" token="showToken" searchWhenChanged="true">
<label>...</label>
<choice value="yes">Yes</choice>
<choice value="no">No</choice>
<change>
<condition match="$value$ == &quot;yes&quot;">
<set token="showToken">true</set>
</condition>
<condition match="$value$ == &quot;no&quot;">
<unset token="showToken"></unset>
</condition>
</change>

 

is there a better way to accomplish this easily? I saw an older post that said using javascript could work but I need to do this through only XML at this time.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...