Dashboards & Visualizations

How to display panels dynamically depends on selection ?

Jouman
Path Finder

Hi All,

Previously, I have asked a question titled as "How to display panels dynamically depends on selection ?" (link). 

I have a similar issue that I need to display panels dynamically depends on user selection in a filter.

However, the user selection is no longer in categories, but from the packet_size in index="my index" within 24 hours.

Therefore, the options in this filter becomes dynamic and what the user selects is dynamic as well.



This is the search code in this filter:

 

index="my_idx" "*PING DATA*"
| stats count by ping_pkt_size

 

 and the output will be:

ping_pkt_sizeCount
40111
12830
52010

... other ping_pkt_size are possible.


Is it possible to display panels accordingly and dynamically depends on user selection?  ex. if the user selects 40, then display the analysis table for packet_size=40. If the user selects 128 and 520, then display 2 analysis tables, one for packet_size=128 and one for packet_size=520.

Do anyone have idea about how to implement this?

Thank you.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden / shown with the depends attribute, however, they still have to be defined. This means you would have to know / decide on the maximum number of panels you want to show. (An alternative to this is to use trellis layout, but this isn't available for table / event panels.)

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="packetsize" searchWhenChanged="true">
      <label>Packet Size</label>
      <search>
        <query>
          ``` Query to generate packet sizes dynamially ```
          | makeresults
          | eval packetsize=split("40,128,520",",")
          | mvexpand packetsize
        </query>
      </search>
      <fieldForValue>packetsize</fieldForValue>
      <fieldForLabel>packetsize</fieldForLabel>
      <delimiter>,</delimiter>
      <change>
        <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval>
        <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval>
        <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval>
        <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval>
        <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$firstpacketsize$">
      <title>First Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$firstpacketsize$"
          </query>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel depends="$secondpacketsize$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$secondpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$thirdpacketsize$">
      <title>Third Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$thirdpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fourthpacketsize$">
      <title>Fourth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fourthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fifthpacketsize$">
      <title>Fifth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fifthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be hidden / shown with the depends attribute, however, they still have to be defined. This means you would have to know / decide on the maximum number of panels you want to show. (An alternative to this is to use trellis layout, but this isn't available for table / event panels.)

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="packetsize" searchWhenChanged="true">
      <label>Packet Size</label>
      <search>
        <query>
          ``` Query to generate packet sizes dynamially ```
          | makeresults
          | eval packetsize=split("40,128,520",",")
          | mvexpand packetsize
        </query>
      </search>
      <fieldForValue>packetsize</fieldForValue>
      <fieldForLabel>packetsize</fieldForLabel>
      <delimiter>,</delimiter>
      <change>
        <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval>
        <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval>
        <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval>
        <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval>
        <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$firstpacketsize$">
      <title>First Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$firstpacketsize$"
          </query>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel depends="$secondpacketsize$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$secondpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$thirdpacketsize$">
      <title>Third Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$thirdpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fourthpacketsize$">
      <title>Fourth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fourthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fifthpacketsize$">
      <title>Fifth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fifthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Jouman
Path Finder

thank you so much. This works!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use that filter search for generate selection list. Here is couple of old answers:

You could find more information from Splunk visualisation documentations.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...