Dashboards & Visualizations

How to display panels dynamically depends on selection ?

Jouman
Path Finder

Hi All,

Previously, I have asked a question titled as "How to display panels dynamically depends on selection ?" (link). 

I have a similar issue that I need to display panels dynamically depends on user selection in a filter.

However, the user selection is no longer in categories, but from the packet_size in index="my index" within 24 hours.

Therefore, the options in this filter becomes dynamic and what the user selects is dynamic as well.



This is the search code in this filter:

 

index="my_idx" "*PING DATA*"
| stats count by ping_pkt_size

 

 and the output will be:

ping_pkt_sizeCount
40111
12830
52010

... other ping_pkt_size are possible.


Is it possible to display panels accordingly and dynamically depends on user selection?  ex. if the user selects 40, then display the analysis table for packet_size=40. If the user selects 128 and 520, then display 2 analysis tables, one for packet_size=128 and one for packet_size=520.

Do anyone have idea about how to implement this?

Thank you.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden / shown with the depends attribute, however, they still have to be defined. This means you would have to know / decide on the maximum number of panels you want to show. (An alternative to this is to use trellis layout, but this isn't available for table / event panels.)

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="packetsize" searchWhenChanged="true">
      <label>Packet Size</label>
      <search>
        <query>
          ``` Query to generate packet sizes dynamially ```
          | makeresults
          | eval packetsize=split("40,128,520",",")
          | mvexpand packetsize
        </query>
      </search>
      <fieldForValue>packetsize</fieldForValue>
      <fieldForLabel>packetsize</fieldForLabel>
      <delimiter>,</delimiter>
      <change>
        <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval>
        <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval>
        <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval>
        <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval>
        <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$firstpacketsize$">
      <title>First Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$firstpacketsize$"
          </query>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel depends="$secondpacketsize$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$secondpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$thirdpacketsize$">
      <title>Third Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$thirdpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fourthpacketsize$">
      <title>Fourth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fourthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fifthpacketsize$">
      <title>Fifth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fifthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden / shown with the depends attribute, however, they still have to be defined. This means you would have to know / decide on the maximum number of panels you want to show. (An alternative to this is to use trellis layout, but this isn't available for table / event panels.)

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="packetsize" searchWhenChanged="true">
      <label>Packet Size</label>
      <search>
        <query>
          ``` Query to generate packet sizes dynamially ```
          | makeresults
          | eval packetsize=split("40,128,520",",")
          | mvexpand packetsize
        </query>
      </search>
      <fieldForValue>packetsize</fieldForValue>
      <fieldForLabel>packetsize</fieldForLabel>
      <delimiter>,</delimiter>
      <change>
        <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval>
        <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval>
        <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval>
        <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval>
        <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$firstpacketsize$">
      <title>First Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$firstpacketsize$"
          </query>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel depends="$secondpacketsize$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$secondpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$thirdpacketsize$">
      <title>Third Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$thirdpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fourthpacketsize$">
      <title>Fourth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fourthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fifthpacketsize$">
      <title>Fifth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fifthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Jouman
Path Finder

thank you so much. This works!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use that filter search for generate selection list. Here is couple of old answers:

You could find more information from Splunk visualisation documentations.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...