Dashboards & Visualizations

How can i make a dropdown disappear based on a token value?

singhbc
Path Finder

I need to have a dropdown appear and disappear in a dashboard, based on a value of a token which will get set using a search query. Is there a way to accomplish that in simple XML?

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

Tokens work on field inputs too. Here is an example I threw together. If you set the the "Number of results to make" field to 1, the dropdown will disappear. If you set the field to a number larger than 1, the dropdown will appear.

<form>
    <label>Hide Dropdown</label>
    <description>If more than result is shown, the "Magic dropdown" will disappear.</description>
    <fieldset submitButton="true" autoRun="false">
        <input type="text" token="result_count">
            <label>Number of results to make:</label>
            <default>1</default>
        </input>
        <input type="dropdown" token="field1" depends="$show_dropdown$">
           <label>Magic dropdown:</label>
           <choice value="1">1</choice>
           <choice value="2">2</choice>
        </input>
  </fieldset>
 <row>
    <panel>
      <table>
         <search>
           <query>| makeresults count=$result_count$</query>
           <done>
             <condition match="$job.resultCount$ > 1">
               <set token="show_dropdown">true</set>
             </condition>
             <condition>
               <unset token="show_dropdown"></unset>
             </condition>
           </done>
         </search>
       </table>
     </panel>
   </row>
</form>

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

Tokens work on field inputs too. Here is an example I threw together. If you set the the "Number of results to make" field to 1, the dropdown will disappear. If you set the field to a number larger than 1, the dropdown will appear.

<form>
    <label>Hide Dropdown</label>
    <description>If more than result is shown, the "Magic dropdown" will disappear.</description>
    <fieldset submitButton="true" autoRun="false">
        <input type="text" token="result_count">
            <label>Number of results to make:</label>
            <default>1</default>
        </input>
        <input type="dropdown" token="field1" depends="$show_dropdown$">
           <label>Magic dropdown:</label>
           <choice value="1">1</choice>
           <choice value="2">2</choice>
        </input>
  </fieldset>
 <row>
    <panel>
      <table>
         <search>
           <query>| makeresults count=$result_count$</query>
           <done>
             <condition match="$job.resultCount$ > 1">
               <set token="show_dropdown">true</set>
             </condition>
             <condition>
               <unset token="show_dropdown"></unset>
             </condition>
           </done>
         </search>
       </table>
     </panel>
   </row>
</form>
0 Karma

singhbc
Path Finder

why the following is not working? I made some changes.

<form>
     <label>Hide Dropdown</label>
     <description>If more than 1 result is shown, the "Magic dropdown" will disappear.</description>
     <fieldset submitButton="false" autoRun="true">

         <input type="dropdown" token="field1" depends="$show_dropdown$">
            <label>Magic dropdown:</label>
            <choice value="1">1</choice>
            <choice value="2">2</choice>
         </input>
   </fieldset>
  <row>
     <panel>
       <table>
          <search>
            <query>| rest /services/authentication/current-context splunk_server=local 
            |stats list(username) as username list(roles) as roles list(defaultApp) as defaultApp 
            | stats count by roles 
            | eval territory=substr(roles, 1, 2) 
            | head 1 
            | eval ter=case(territory="ad", 2)
            </query>
            <done>
              <condition match="ter > 1">
                <set token="show_dropdown">true</set>
              </condition>
              <condition>
                <unset token="show_dropdown"></unset>
              </condition>
            </done>
          </search>
        </table>
      </panel>
    </row>
 </form>
0 Karma

jconger
Splunk Employee
Splunk Employee

Change your condition match to the following:

<condition match="'result.ter' > 1">
    <set token="show_dropdown">true</set>
</condition>
0 Karma

singhbc
Path Finder

Thanks! works like a charm!

0 Karma

davpx
Communicator
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...