Dashboards & Visualizations
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to achieve a token value change based on dropdown?

mjon395
Explorer
‎10-14-2022 07:49 AM

Hi All,

I have a dashboard with a dropdown of about 40 choices that come from a search query (not static).

Each choice should "unhide" the respective panel on the dashboard. 

I do not think I am grasping the <done>, <change>, <finalized>, <condition match>, etc elements I need to figure this out.  I have created a dummy version of my actual dashboard below:

 

 

 

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

 

 

 You will notice I do not have any code to decipher when showapple or showorange is true.  I basically tried iterations of this code to make it work:

 

 

 

          <done>
            <condition>
              <eval token="showapple">if($dashboard$="Apple","TRUE",null())</eval>
<eval token="showorange">if($dashboard$="Orange","TRUE",null())</eval>
            </condition>
          </done>

 

 

 

I have tried using the above in different areas, and I always get null().  I also tried doing <change> instead of <done> so the dashboards would change depending on the dropdown value instantly, but I did not have success there either.

Labels (3)
Labels
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎10-14-2022 09:22 AM 
<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma
Reply
Solved! Jump to solution

ccorte
Loves-to-Learn
‎01-21-2025 09:44 PM

what is the json syntax? documentation is not clear

0 Karma
Reply
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎10-14-2022 09:22 AM 
<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>| makeresults
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Reply
Solved! Jump to solution

mjon395
Explorer
‎10-14-2022 09:51 AM

Perfect, as desired.  I don't think I was close to the change and == eval tokens as you set, so you saved me a lot (more) headache.

I have additionally added extra tokens so only the specific dashboards load the query (I think?).  So instead of all 40 dashboards loading in the background, the queries fail to load unless the respective token is true.

<form>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="dashboard">
      <label>Dashboard Selection</label>
      <fieldForLabel>Picker</fieldForLabel>
      <fieldForValue>Picker</fieldForValue>
      <search>
        <query>| makeresults
| eval Picker = "Apple,Orange"
| eval Picker = split(Picker,",")
| stats count by Picker</query>
      </search>
      <change>
        <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval>
        <eval token="searchapple">if($showapple$=="TRUE","| makeresults", null())</eval>
        <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval>
        <eval token="searchorange">if($showorange$=="TRUE","| makeresults", null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>DEBUG TOKENS : : : showapple - $showapple$ ($searchapple$) || showorange - $showorange$ ($searchorange$) || dashboard - $dashboard$</html>
    </panel>
  </row>
  <row>
    <panel depends="$showapple$">
      <title>Apple Dashboard</title>
      <table>
        <search>
          <query>$searchapple$
| eval Events = "10.10.10.10"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showorange$">
      <title>Orange Dashboard</title>
      <table>
        <search>
          <query>$searchorange$
| eval Events = "192.168.1.1"
| table Events</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Is there an issue with this method to prevent the "inactive" panels from queueing up queries? (searchapple, searchorange)

0 Karma
Reply
Solved! Jump to solution

jdunlea
Contributor
‎10-14-2022 08:26 AM

If your dropdown is a non-static list of choices that come from a search query, how do you have a "respective panel" for each dropdown choice? If you have a respective panel for each dropdown choice, that implies that you know upfront how many dropdown options there can be. 

0 Karma
Reply
Solved! Jump to solution

mjon395
Explorer
‎10-14-2022 08:59 AM

In the actual dashboard, the dropdown search is looking for all values within a lookup.  These values never change; it's just simpler to use the lookup to spit the values out rather than typing in the values one by one.

The only reason I mentioned that the dropdown panel uses a search for the values was because I was not sure if this would change the solution needed compared to using static options.

0 Karma
Reply
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Take the Survey

Can’t make it to .conf25? Join us online!

Watch Global Broadcast
Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...