Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to achieve a token value change based on dropdown?

mjon395
Explorer
‎10-14-2022 07:49 AM

Hi All,

I have a dashboard with a dropdown of about 40 choices that come from a search query (not static).

Each choice should "unhide" the respective panel on the dashboard. 

I do not think I am grasping the <done>, <change>, <finalized>, <condition match>, etc elements I need to figure this out.  I have created a dummy version of my actual dashboard below:

 

 

 

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

 

 

 You will notice I do not have any code to decipher when showapple or showorange is true.  I basically tried iterations of this code to make it work:

 

 

 

          <done>
            <condition>
              <eval token="showapple">if($dashboard$="Apple","TRUE",null())</eval>
<eval token="showorange">if($dashboard$="Orange","TRUE",null())</eval>
            </condition>
          </done>

 

 

 

I have tried using the above in different areas, and I always get null().  I also tried doing <change> instead of <done> so the dashboards would change depending on the dropdown value instantly, but I did not have success there either.

Labels (3)
Labels
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎10-14-2022 09:22 AM 
<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎10-14-2022 09:22 AM 
<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Reply
Solved! Jump to solution

mjon395
Explorer
‎10-14-2022 09:51 AM

Perfect, as desired.  I don't think I was close to the change and == eval tokens as you set, so you saved me a lot (more) headache.

I have additionally added extra tokens so only the specific dashboards load the query (I think?).  So instead of all 40 dashboards loading in the background, the queries fail to load unless the respective token is true.

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="searchapple">if($showapple$=="TRUE","| makeresults", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
        <eval token="searchorange">if($showorange$=="TRUE","| makeresults", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ ($searchapple$) || showorange - $showorange$ ($searchorange$) || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>$searchapple$
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>$searchorange$
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Is there an issue with this method to prevent the "inactive" panels from queueing up queries? (searchapple, searchorange)

0 Karma
Reply
Solved! Jump to solution

jdunlea
Contributor
‎10-14-2022 08:26 AM

If your dropdown is a non-static list of choices that come from a search query, how do you have a "respective panel" for each dropdown choice? If you have a respective panel for each dropdown choice, that implies that you know upfront how many dropdown options there can be. 

0 Karma
Reply
Solved! Jump to solution

mjon395
Explorer
‎10-14-2022 08:59 AM

In the actual dashboard, the dropdown search is looking for all values within a lookup.  These values never change; it's just simpler to use the lookup to spit the values out rather than typing in the values one by one.

The only reason I mentioned that the dropdown panel uses a search for the values was because I was not sure if this would change the solution needed compared to using static options.

0 Karma
Reply
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...