Solved: How to achieve a token value change based on dropd...

mjon395 · ‎10-14-2022

Hi All,

I have a dashboard with a dropdown of about 40 choices that come from a search query (not static).

Each choice should "unhide" the respective panel on the dashboard.

I do not think I am grasping the <done>, <change>, <finalized>, <condition match>, etc elements I need to figure this out. I have created a dummy version of my actual dashboard below:

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

You will notice I do not have any code to decipher when showapple or showorange is true. I basically tried iterations of this code to make it work:

          <done>
            <condition>
              <eval token="showapple">if($dashboard$="Apple","TRUE",null())</eval>
<eval token="showorange">if($dashboard$="Orange","TRUE",null())</eval>
            </condition>
          </done>

I have tried using the above in different areas, and I always get null(). I also tried doing <change> instead of <done> so the dashboards would change depending on the dropdown value instantly, but I did not have success there either.

ITWhisperer · ‎10-14-2022

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

ITWhisperer · ‎10-14-2022

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

mjon395 · ‎10-14-2022

Perfect, as desired. I don't think I was close to the change and == eval tokens as you set, so you saved me a lot (more) headache.

I have additionally added extra tokens so only the specific dashboards load the query (I think?). So instead of all 40 dashboards loading in the background, the queries fail to load unless the respective token is true.

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="searchapple">if($showapple$=="TRUE","| makeresults", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
        <eval token="searchorange">if($showorange$=="TRUE","| makeresults", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ ($searchapple$) || showorange - $showorange$ ($searchorange$) || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>$searchapple$
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>$searchorange$
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Is there an issue with this method to prevent the "inactive" panels from queueing up queries? (searchapple, searchorange)

jdunlea · ‎10-14-2022

If your dropdown is a non-static list of choices that come from a search query, how do you have a "respective panel" for each dropdown choice? If you have a respective panel for each dropdown choice, that implies that you know upfront how many dropdown options there can be.

mjon395 · ‎10-14-2022

In the actual dashboard, the dropdown search is looking for all values within a lookup. These values never change; it's just simpler to use the lookup to spit the values out rather than typing in the values one by one.

The only reason I mentioned that the dropdown panel uses a search for the values was because I was not sure if this would change the solution needed compared to using static options.

How to achieve a token value change based on dropdown?

panel

table

token

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

Monitoring Amazon Elastic Kubernetes Service (EKS)