Dashboards & Visualizations

How to combine 2 dashboards, each with multiple panels, into one dashboard with tabs to switch between the two types of data?

splunker9999
Path Finder

Hi,

We have 2 dashboards and each have multiple panels.

Ex:
Dashboard 1: It lists all today's data for multiple inline searches, so we used multiple panels here on this dashboard.
Dashboard 2: We have all trending data with multiple panels here.

Now we need to combine these 2 dashboards into a single dashboard with tabs as (Today's and Trending), is there a way to do this?

If we have single panel, we can build tabs using below html tags, but need your help, like how can we build this for a dashboard with multiple panels.

Used this for creating tabs in a single panel dashboard:

<ul>
       <li>
  <a href="#" class="toggle-tab" data-toggle="tab" data-elements="Testing">Testing</a>
      </li>
</ul>

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi splunker9999

There is an examples app on splunkbase.com which contains an example like the one you are describing.

Splunk 6.x Dashboard Examples
https://splunkbase.splunk.com/app/1603/

The example in question is called "Link switcher". The example code is pretty long and might be difficult to understand but you get a working example inside the app which makes it easier. You are basically using tokens and panel dependencies.

Let me know how you get along.

j

<form>
    <label>Link Switcher</label>
    <description>Toggle dashboard content using a list of links.</description>
    <fieldset submitButton="false">
        <input type="link" token="unused">
            <label>Choose a view</label>
            <choice value="table">Table</choice>
            <choice value="chart">Chart</choice>
            <choice value="map">Map</choice>
            <default>Table</default>
            <change>
                <condition value="table">
                    <set token="showTable">true</set>
                    <unset token="showChart"></unset>
                    <unset token="showMap"></unset>
                </condition>
                <condition value="chart">
                    <set token="showChart">true</set>
                    <unset token="showTable"></unset>
                    <unset token="showMap"></unset>
                </condition>
                <condition value="map">
                    <set token="showMap">true</set>
                    <unset token="showChart"></unset>
                    <unset token="showTable"></unset>
                </condition>
            </change>
        </input>
    </fieldset>
    <row>
        <panel>
            <table depends="$showTable$">
                <title>Table</title>
                <search>
                    <query>index=_internal | stats count by sourcetype</query>
                    <earliest>-24h</earliest>
                    <latest>now</latest>
                </search>
            </table>
            <chart depends="$showChart$">
                <title>Chart</title>
                <search>
                    <query>index=_internal | stats count by sourcetype</query>
                    <earliest>-24h</earliest>
                    <latest>now</latest>
                </search>
            </chart>
            <map depends="$showMap$">
                <title>Map</title>
                <search>
                    <query>| inputlookup geomaps_data.csv | iplocation device_ip | geostats latfield=lat longfield=lon count by method</query>
                    <earliest>0</earliest>
                    <latest>now</latest>
                </search>
                <option name="mapping.map.center">(30.810646,-10.556976)</option>
                <option name="mapping.map.zoom">2</option>
            </map>
        </panel>
</row>
    <row>
        <panel>
            <input type="link" token="needed">
                <label>Choose a sourcetype:</label>
                <choice value="link4">Internal Event Count</choice>
                <choice value="link5">Splunk Event Count</choice>
                <default>Internal Event Count</default>
                <change>
                    <condition value="link4">
                        <set token="showInternal">true</set>
                        <unset token="showSplunkd"></unset>
                    </condition>
                    <condition value="link5">
                        <unset token="showInternal"></unset>
                        <set token="showSplunkd">true</set>
                    </condition>
                </change>
            </input>
                <single depends="$showInternal$">
                    <title>Internal event count</title>
                    <search>
                        <query>index=_internal | stats count</query>
                        <earliest>-24h</earliest>
                        <latest>now</latest>
                    </search>
                </single>
                <single depends="$showSplunkd$">
                    <title>Splunkd event count</title>
                    <search>
                        <query>index=_internal sourcetype=splunkd | stats count</query>
                        <earliest>-24h</earliest>
                        <latest>now</latest>
                    </search>
                </single>
        </panel>
    </row>
</form>
0 Karma

splunker9999
Path Finder

Hi,

Thanks for your response!!

Does this link switcher only works in version 6.3, we have 6.2.3 and facing below error when try to edit code using Link Switcher?

or do we need to configure object mappers? can you please advice.
XML Syntax Error: Cannot find object mapper for input type: link

0 Karma

somesoni2
Revered Legend

Change link to dropdown

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!