How do I add custom behavior for one dashboard panel?

[hollybross1219]

I'm trying to edit the source code of my dashboard to create a panel that only produces results if a text field input (value of my token called $partner$) is NOT "". If $partner$=, I don't want this panel to produce anything.

By default, I have $partner$=* based on how I've configured my other panels. I've consulted several articles and Splunk documentation and am stumped on what I'm not doing correctly. Thanks you for helping!

 <search>
      <done>            
      <condition match="$partner$=*">
          <unset token="partner">t1</unset>
        </condition>
        <condition match="$partner$!=*">
          <set token="partner">t1</set>
        </condition>
      </done>
      <query> [SEARCH QUERY HERE] </query>
      <earliest>-30d@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>

[manjunathmeti]

Unset token $partner$ in text field input if no input is provided. Show the panel only when token is set. Check if this works for you.

<form>
  <label>Label</label>
  <fieldset submitButton="true">
    <input type="text" token="partner">
      <label>Input text</label>
      <change>
        <condition value="">
          <unset token="partner"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$partner$">
      <title>Panel 1</title>
      <table>
        <title>Count by sourcetype</title>
        <search>
          <query>index=_internal earliest=-5m | stats count by sourcetype</query>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

[hollybross1219]

@manjunathmeti -- this doesn't work for my use case because altering the token would affect my other dashboards, which is not what I want. The aim is that one particular search criteria in the token ("*") works for all panels except for 1.

[manjunathmeti]

Hi @hollybross1219,

Try this. Here your panel 1 depends on token partner1 and this token is only set when value of inout text is not "*".

<form>
   <label>Label</label>
   <fieldset submitButton="true">
     <input type="text" token="partner">
       <label>Input text</label>
       <change>
         <condition match="$value$!=&quot;*&quot;">
           <set token="partner1">$value$</set>
         </condition>
         <condition>
           <unset token="partner1"></unset>
         </condition>
       </change>
     </input>
   </fieldset>
   <row>
     <panel depends="$partner1$">
       <title>Panel 1</title>
       <table>
         <title>Count by sourcetype</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by sourcetype</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <title>Panel 2</title>
       <table>
         <title>Count by source</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by source</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </form>

[kdroddy]

Have you check out the 'depends' command to see if that will work for your needs?

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/PanelreferenceforSimplifiedXML

[hollybross1219]

@kdroddy -- The documentation around depends is very confusing. basically how i understand it is that it checks whether the token is set or not. My intent is not to unset the token where all panels would be affected. My intent is that if token value has a certain value ($token$=*), then it works on all panels except for 1.