Dashboards & Visualizations

How to display different tables in a dashboard based on different conditions ?

chris7535
Engager

I have a dashboard that let's users enter in the type of events they want to search for. Every type of event returns a different set of fields which is then displayed in a table. Since the final output is a single table I have to account for every possible field that may generate from all events, if a field does not apply to a event I used eval to set the value for that field to "not applicable".

Is there a way to show a different table (with different fields) depending on a condition that is selected ? I would have imaged that just using this at the end would do the job but no, instead only the first eval is evaluated.

             | eval ShowTable = if(EventCode=="1")   | table  Time,Host,DN,Status
             | eval ShowTable = if(EventCode=="2")   | table  Time,Host,PN,Value
             | eval ShowTable = if(EventCode=="3")   | table  Time,Host,Action,Status
Tags (1)

DavidHourani
Super Champion

Hi @chris7535,

Using the query you posted above after the first tablecommand you no longer have the EventCode fields not the Values or Action field so the other evals will do nothing and the tables as well.

If you want to control the way a dashboard or table is presented based on a token you need to use conditional tokens as shown here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/tokens
And here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/ContextualDrilldown#Configure_conditional_beh...

Let me know if that helps.

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...