Dashboards & Visualizations

How do I add custom behavior for one dashboard panel?

hollybross1219
Path Finder

I'm trying to edit the source code of my dashboard to create a panel that only produces results if a text field input (value of my token called $partner$) is NOT "". If $partner$=, I don't want this panel to produce anything.

By default, I have $partner$=* based on how I've configured my other panels. I've consulted several articles and Splunk documentation and am stumped on what I'm not doing correctly. Thanks you for helping!

 <search>
      <done>            
      <condition match="$partner$=*">
          <unset token="partner">t1</unset>
        </condition>
        <condition match="$partner$!=*">
          <set token="partner">t1</set>
        </condition>
      </done>
      <query> [SEARCH QUERY HERE] </query>
      <earliest>-30d@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Unset token $partner$ in text field input if no input is provided. Show the panel only when token is set. Check if this works for you.

<form>
  <label>Label</label>
  <fieldset submitButton="true">
    <input type="text" token="partner">
      <label>Input text</label>
      <change>
        <condition value="">
          <unset token="partner"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$partner$">
      <title>Panel 1</title>
      <table>
        <title>Count by sourcetype</title>
        <search>
          <query>index=_internal earliest=-5m | stats count by sourcetype</query>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

hollybross1219
Path Finder

@manjunathmeti -- this doesn't work for my use case because altering the token would affect my other dashboards, which is not what I want. The aim is that one particular search criteria in the token ("*") works for all panels except for 1.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @hollybross1219,

Try this. Here your panel 1 depends on token partner1 and this token is only set when value of inout text is not "*".

<form>
   <label>Label</label>
   <fieldset submitButton="true">
     <input type="text" token="partner">
       <label>Input text</label>
       <change>
         <condition match="$value$!=&quot;*&quot;">
           <set token="partner1">$value$</set>
         </condition>
         <condition>
           <unset token="partner1"></unset>
         </condition>
       </change>
     </input>
   </fieldset>
   <row>
     <panel depends="$partner1$">
       <title>Panel 1</title>
       <table>
         <title>Count by sourcetype</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by sourcetype</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <title>Panel 2</title>
       <table>
         <title>Count by source</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by source</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </form>
0 Karma

kdroddy
Explorer

Have you check out the 'depends' command to see if that will work for your needs?

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/PanelreferenceforSimplifiedXML

0 Karma

hollybross1219
Path Finder

@kdroddy -- The documentation around depends is very confusing. basically how i understand it is that it checks whether the token is set or not. My intent is not to unset the token where all panels would be affected. My intent is that if token value has a certain value ($token$=*), then it works on all panels except for 1.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...