How to create Splunk dashboard with variable number of panels based on dropdown value selected?

[sdkp03]

Requirement is that we have a dropdown with a list of options. One of the option is all. I have a search query which will try to fetch events based on the selected values. Now I want to group them by name and display individual panel for every name in the dropdown. Example below:

Dropdown :- UAE, USA, India, Australia, UK, ALL

Search query :- index=population name=<$dropdownvalue> | timechart count sum(people) span=1d

Expectation: When I select name as UAE, panel displays timechart related to UAE population. However when option ALL is selected, I want to display 5 panels with each panel displaying timechart of specific country population. Is that feasible. Tried searching all articles and splunk documentation with no luck. 

[ITWhisperer]

Set the value for All ="*"

index=population name=<$dropdownvalue> | timechart span=1d sum(people) by name

Then use the trellis option on field name

[gcusello]

Hi @sdkp03,

yes you can display or not a panel based on a token from an input, an example about this in in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603).

Ciao.

Giuseppe

[sdkp03]

@gcusello is there a way I can assign a token with entire search query including the wild card characters.

<input type="dropdown" token="" searchWhenChanged="true">

<choice value="1">xxxxx</choice>

<choice value="2">yyyyy</choice>

<change>

      <condition value="1">

          <set token="search_query">

index=ssss "<base search criteria>" | rex command to execute 2 fields | eval for date time conversion | timechart | eval to validate range to find if the count was in expected range

</set>  ------- code breaks here with error - Unexpected close tag

Basically the rex which has wild card character search is the cause for the error. Am trying to find which is the character that I should escape. Struggling to figure out as I have all characters in there _,.*()\ etc., Any help in this regard would be much appreciated

[ITWhisperer · Accepted solution]

This is html so if you really have "<base search criteria>" in your search you would need to escape the < as &lt; and the > as &gt; and there may be other html characters you would need to escape (but &lt; and &gt; are usually the culprits)

[sdkp03]

I am not sure if I have conveyed my question right. I mean to write code for just one panel which is capable of displaying based on the requirement. I don't want to  write too many queries/lines of code which will make it hard to maintain when the number of options in the dropdown is expected to exceed beyond 20!

[sdkp03]

are you saying that I need to have hardcoded panels set and just set or unset token based on the value selected. Is that right! What I mean is I will have one panel which caters to the need of displaying based on selected value "index=population name=<$dropdownvalue> | timechart count sum(people) span=1d" and remaining 5 panels with 5 different queries "index=population name='USA' | timechart count sum(people) span=1d" and 4 more with respective name. Based on the value selected set/unset token to get required detail! 

[bowesmana]

You would only need a single base search to do the initial query, but then every other panel would use that base search then use a | where clause to filter out only the data for that panel.

However, @ITWhisperer solution would seem like a far easier option - does that not work for you?

[sdkp03]

I wish what am trying to achieve is as simple as I conveyed. I did try setting a base query and then tried rebuilding query based on panel. However this is again adding too many panels to get the right query to be executed. I stumbled upon this discussion "https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-dashboard-panels-dynamicall... . Here search query is set based on change of dropdown value and in the panel just execute to visualise the chart with right values(referring to the solution by gyslainlatsa)

. However when I tried doing the same, I am getting an error which says unexpected close tag. I also noticed later that it was a very old thread with reference links broken.  Any idea how I can achieve this in latest version. 

My search query I am trying to set as token on condition value looks like this:

index=ssss "<base search criteria>" | rex command to execute 2 fields | eval for date time conversion | timechart | eval to validate range to find if the count was in expected range

Basically the rex which has wild card character search is the cause for the error. Am trying to find which is the character that I should escape. Struggling to figure out as I have all characters in there _,.*()\ etc., Any help in this regard would be much appreciated

[gcusello]

Hi @sdkp03,

as I said, yes it's possible, see in the above app how to hide or display a panel in a dashboard based on a condition (e.g. a token).

Ciao.

Giuseppe