Dashboards & Visualizations

How to display panel based on the value of a search?

Barty
Explorer

Good morning all,

I'm hoping someone may be able to assist me quickly and easily. I have a dashboard that shows a number of panels that return a status of batch jobs. Thing is, these batch jobs only run at 1:30pm and 4pm. As such, to make the dashboard a little more dynamic, I'd like to hide the panels for 1:30pm prior to the time being 1:30pm and likewise for 4pm. 

I have a hidden search that calculates current date and time, then I create two fields called time_check1 and time_check2. These two fields have a value of Yes or No depending on whether time_check1 is before 1:30pm (Yes, No) and likewise the second checks if it is before 4pm.

Now, what I want to do is only show the 1:30pm panels when time_check1 is = Yes, and the same again for 4pm panels when time_check2 is Yes. I have done a fair amount of searching through here and can see lots of questions about utilising dropdowns and inputs for this, but mine is a static hidden search that I simply need to display the panels when criteria is met (the value of Yes). 

Would anyone please be able to assist me? I'm sure there must be something along the lines of <panel depends="$time_check1$=YES"> or similar?

Thank you in advance.

Labels (4)
Tags (2)
0 Karma
1 Solution

niketn
Legend

@Barty you would need to take care of token assignment in your independent search event handler itself. How depends and rejects works is based on whether the token is set or it is null. It does not work based on what value does the token have.

Following is a run anywhere search that should set the required tokens. PS I am setting a third token for other time which do not match either of the time criteria you mentioned.

 

  <search>
    <query>| makeresults
| eval HourMinute=strftime(now(),"%H:%M:%S")
| eval time=case(HourMinute&gt;="13:30:00" AND HourMinute&lt;"16:00:59","Afternoon",HourMinute&gt;="16:00:00" AND HourMinute&lt;"23:59:59", "Evening",true(),"Morning")
    </query>
    <earliest>-1s</earliest>
    <latest>now</latest>
    <done>
      <condition match="$result.time$==&quot;Afternoon&quot;">
        <set token="time">$result.time$</set>
        <set token="showAfternoonPanel">true</set>
        <unset token="showEveningPanel"></unset>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition match="$result.time$==&quot;Evening&quot;">
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <set token="showEveningPanel">true</set>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition>
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <unset token="showEveningPanel"></unset>
        <set token="showMorningPanel">true</set>
      </condition>
    </done>
  </search>

 

Following is the Panel code for you to test the above code...

  <row>
    <panel depends="$showAfternoonPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showEveningPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showMorningPanel$">
      <html>$time$ Panel</html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Barty you would need to take care of token assignment in your independent search event handler itself. How depends and rejects works is based on whether the token is set or it is null. It does not work based on what value does the token have.

Following is a run anywhere search that should set the required tokens. PS I am setting a third token for other time which do not match either of the time criteria you mentioned.

 

  <search>
    <query>| makeresults
| eval HourMinute=strftime(now(),"%H:%M:%S")
| eval time=case(HourMinute&gt;="13:30:00" AND HourMinute&lt;"16:00:59","Afternoon",HourMinute&gt;="16:00:00" AND HourMinute&lt;"23:59:59", "Evening",true(),"Morning")
    </query>
    <earliest>-1s</earliest>
    <latest>now</latest>
    <done>
      <condition match="$result.time$==&quot;Afternoon&quot;">
        <set token="time">$result.time$</set>
        <set token="showAfternoonPanel">true</set>
        <unset token="showEveningPanel"></unset>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition match="$result.time$==&quot;Evening&quot;">
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <set token="showEveningPanel">true</set>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition>
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <unset token="showEveningPanel"></unset>
        <set token="showMorningPanel">true</set>
      </condition>
    </done>
  </search>

 

Following is the Panel code for you to test the above code...

  <row>
    <panel depends="$showAfternoonPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showEveningPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showMorningPanel$">
      <html>$time$ Panel</html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

yvassilyeva
Path Finder

@niketn 

How can I show panel dynamically? In this example you manually set the result, but what if I want to display the panel based on the result of the search that was picked from dropdown?

Scenario:
I have a dropdown with options: East, West, South and North. When i pick East from my dropdown and East populates in my panel, i'd like to show my panel. However if East is not populated in my search i want to hide the panel. Is there a way to do it dynamically?

 

Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is an old question with an accepted answer so it's unlikely many will see your question.  I suggest you post a new question.

BTW, niketnilay is no longer with us so there's no need to tag him.

---
If this reply helps you, Karma would be appreciated.

yvassilyeva
Path Finder

Thanks for the heads up!

0 Karma

Barty
Explorer

Perfect!! Thank you so much for this

richgalloway
SplunkTrust
SplunkTrust

The depends attribute tests for the presence of a token, not its value.  If you can get your tokens to be present only when the panel should be seen then you can use

 

<panel depends=$time_check1$>
...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Barty
Explorer

Thank you for the response.

As mentioned, the search that builds the values runs on load and then identifies if it is prior to 1:30pm, or 4pm. I appreciate the depends element relies on the prescence of a token, I'm wondering if you can trigger the panel display based on the value of the token present??

0 Karma

richgalloway
SplunkTrust
SplunkTrust
As I said, the depends attribute tests for the presence of a token, not its value. You can use conditions, however, to test a token value and set a depends token. See https://docs.splunk.com/Documentation/Splunk/8.0.5/Viz/ContextualDrilldown#Configure_conditional_beh... .
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...