Dashboards & Visualizations

How to change panel visibility based on tokens set by another panel search?

samjoshiacademi
Explorer

I have 4 panels.

  1. 1st Panel gives me Good vs Bad Services stats.
  2. 2nd Panel gives me Error Count
  3. I want to display 3rd panel if first two Panels looks good(1st Panel - 10 Good Services and 0 Bad Services..... 2nd Panel - 0 ErrorCount) And, i will show 4th panel if first two panels looks otherwise (with an issue).

****Code ::
//1st Panel//

  <table>
    <search id="dms2">
      <query><somesearch>| chart count over Validation by Status</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
      <done>
      <eval token="dms01">false</eval>
      </done>
      <progress>
         <condition match="$result.Good$ < 7">
           <set token="dms01">true</set>
         </condition>
       </progress>
    </search>
   ........
   .......
  </table>
</panel>

//2nd panel//

  <table>
    <search id="dms3">
      <query><somesearch> | fields ErrValidation</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    .........
    .........
  </table>
</panel>

//3rd Panel//

  <table>
    <search id="dms4">
      <query>|stats count</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">10</option>
    <option name="drilldown">cell</option>
    <option name="refresh.display">progressbar</option>
    <format type="color" field="Status">
      <colorPalette type="map">{"No Error":#FFFFFF}</colorPalette>
    </format>
  </table>
</panel>

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this sample, it will show third panel only if temp<=10 in 1st panel and errorcount =0 in second panel. I guess with this you can build your logic

<dashboard>
  <label>panel</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults |eval temp=10</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition match="'result.temp'<=10">
              <set token="show1">true</set>
            </condition>
              <condition>
              <unset token="show1"></unset>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults |eval errorcount=0</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition match="'result.errorcount'==&quot;0&quot;">
              <set token="show2">true</set>
            </condition>
            <condition>
             <unset token="show2"></unset>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$show1$,$show2$">
    <panel>
      <table>
        <search>
          <query>|makeresults |eval temp=0</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
         </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

vnravikumar
Champion

Hi

Check this sample, it will show third panel only if temp<=10 in 1st panel and errorcount =0 in second panel. I guess with this you can build your logic

<dashboard>
  <label>panel</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults |eval temp=10</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition match="'result.temp'<=10">
              <set token="show1">true</set>
            </condition>
              <condition>
              <unset token="show1"></unset>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults |eval errorcount=0</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition match="'result.errorcount'==&quot;0&quot;">
              <set token="show2">true</set>
            </condition>
            <condition>
             <unset token="show2"></unset>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$show1$,$show2$">
    <panel>
      <table>
        <search>
          <query>|makeresults |eval temp=0</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
         </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

samjoshiacademi
Explorer

Thanx man !!! Big help 🙂

0 Karma

vnravikumar
Champion

Welcome 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...