Dashboards & Visualizations

How do I add custom behavior for one dashboard panel?

hollybross1219
Path Finder

I'm trying to edit the source code of my dashboard to create a panel that only produces results if a text field input (value of my token called $partner$) is NOT "". If $partner$=, I don't want this panel to produce anything.

By default, I have $partner$=* based on how I've configured my other panels. I've consulted several articles and Splunk documentation and am stumped on what I'm not doing correctly. Thanks you for helping!

 <search>
      <done>            
      <condition match="$partner$=*">
          <unset token="partner">t1</unset>
        </condition>
        <condition match="$partner$!=*">
          <set token="partner">t1</set>
        </condition>
      </done>
      <query> [SEARCH QUERY HERE] </query>
      <earliest>-30d@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Unset token $partner$ in text field input if no input is provided. Show the panel only when token is set. Check if this works for you.

<form>
  <label>Label</label>
  <fieldset submitButton="true">
    <input type="text" token="partner">
      <label>Input text</label>
      <change>
        <condition value="">
          <unset token="partner"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$partner$">
      <title>Panel 1</title>
      <table>
        <title>Count by sourcetype</title>
        <search>
          <query>index=_internal earliest=-5m | stats count by sourcetype</query>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

hollybross1219
Path Finder

@manjunathmeti -- this doesn't work for my use case because altering the token would affect my other dashboards, which is not what I want. The aim is that one particular search criteria in the token ("*") works for all panels except for 1.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @hollybross1219,

Try this. Here your panel 1 depends on token partner1 and this token is only set when value of inout text is not "*".

<form>
   <label>Label</label>
   <fieldset submitButton="true">
     <input type="text" token="partner">
       <label>Input text</label>
       <change>
         <condition match="$value$!=&quot;*&quot;">
           <set token="partner1">$value$</set>
         </condition>
         <condition>
           <unset token="partner1"></unset>
         </condition>
       </change>
     </input>
   </fieldset>
   <row>
     <panel depends="$partner1$">
       <title>Panel 1</title>
       <table>
         <title>Count by sourcetype</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by sourcetype</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <title>Panel 2</title>
       <table>
         <title>Count by source</title>
         <search>
           <query>index=_internal earliest=-5m | stats count by source</query>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </form>
0 Karma

kdroddy
Explorer

Have you check out the 'depends' command to see if that will work for your needs?

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/PanelreferenceforSimplifiedXML

0 Karma

hollybross1219
Path Finder

@kdroddy -- The documentation around depends is very confusing. basically how i understand it is that it checks whether the token is set or not. My intent is not to unset the token where all panels would be affected. My intent is that if token value has a certain value ($token$=*), then it works on all panels except for 1.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...