Dashboards & Visualizations

How do I add custom behavior for one dashboard panel?

hollybross1219
Path Finder

I'm trying to edit the source code of my dashboard to create a panel that only produces results if a text field input (value of my token called $partner$) is NOT "". If $partner$=, I don't want this panel to produce anything.

By default, I have $partner$=* based on how I've configured my other panels. I've consulted several articles and Splunk documentation and am stumped on what I'm not doing correctly. Thanks you for helping!

 <search>
      <done>            
      <condition match="$partner$=*">
          <unset token="partner">t1</unset>
        </condition>
        <condition match="$partner$!=*">
          <set token="partner">t1</set>
        </condition>
      </done>
      <query> [SEARCH QUERY HERE] </query>
      <earliest>-30d@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Unset token $partner$ in text field input if no input is provided. Show the panel only when token is set. Check if this works for you.

<form>
  <label>Label</label>
  <fieldset submitButton="true">
    <input type="text" token="partner">
      <label>Input text</label>
      <change>
        <condition value="">
          <unset token="partner"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$partner$">
      <title>Panel 1</title>
      <table>
        <title>Count by sourcetype</title>
        <search>
          <query>index=_internal earliest=-5m | stats count by sourcetype</query>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

hollybross1219
Path Finder

@manjunathmeti -- this doesn't work for my use case because altering the token would affect my other dashboards, which is not what I want. The aim is that one particular search criteria in the token ("*") works for all panels except for 1.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @hollybross1219,

Try this. Here your panel 1 depends on token partner1 and this token is only set when value of inout text is not "*".

<form>
   <label>Label</label>
   <fieldset submitButton="true">
     <input type="text" token="partner">
       <label>Input text</label>
       <change>
         <condition match="$value$!=&quot;*&quot;">
           <set token="partner1">$value$</set>
         </condition>
         <condition>
           <unset token="partner1"></unset>
         </condition>
       </change>
     </input>
   </fieldset>
   <row>
     <panel depends="$partner1$">
       <title>Panel 1</title>
       <table>
         <title>Count by sourcetype</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by sourcetype</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <title>Panel 2</title>
       <table>
         <title>Count by source</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by source</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </form>
0 Karma

kdroddy
Explorer

Have you check out the 'depends' command to see if that will work for your needs?

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/PanelreferenceforSimplifiedXML

0 Karma

hollybross1219
Path Finder

@kdroddy -- The documentation around depends is very confusing. basically how i understand it is that it checks whether the token is set or not. My intent is not to unset the token where all panels would be affected. My intent is that if token value has a certain value ($token$=*), then it works on all panels except for 1.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...