How to display panels dynamically depends on selection ?

[Jouman]

Hi All,

Previously, I have asked a question titled as "How to display panels dynamically depends on selection ?" (link). 

I have a similar issue that I need to display panels dynamically depends on user selection in a filter.

However, the user selection is no longer in categories, but from the packet_size in index="my index" within 24 hours.

Therefore, the options in this filter becomes dynamic and what the user selects is dynamic as well.

This is the search code in this filter:

index="my_idx" "*PING DATA*"
| stats count by ping_pkt_size

 and the output will be:

ping_pkt_size	Count
40	111
128	30
520	10

... other ping_pkt_size are possible.

Is it possible to display panels accordingly and dynamically depends on user selection?  ex. if the user selects 40, then display the analysis table for packet_size=40. If the user selects 128 and 520, then display 2 analysis tables, one for packet_size=128 and one for packet_size=520.

Do anyone have idea about how to implement this?

Thank you.

[ITWhisperer · Accepted solution]

Panels can be hidden / shown with the depends attribute, however, they still have to be defined. This means you would have to know / decide on the maximum number of panels you want to show. (An alternative to this is to use trellis layout, but this isn't available for table / event panels.)

<form version="1.1">
  <label>Multiselect</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="packetsize" searchWhenChanged="true">
      <label>Packet Size</label>
      <search>
        <query>
          ``` Query to generate packet sizes dynamially ```
          | makeresults
          | eval packetsize=split("40,128,520",",")
          | mvexpand packetsize
        </query>
      </search>
      <fieldForValue>packetsize</fieldForValue>
      <fieldForLabel>packetsize</fieldForLabel>
      <delimiter>,</delimiter>
      <change>
        <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval>
        <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval>
        <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval>
        <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval>
        <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$firstpacketsize$">
      <title>First Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$firstpacketsize$"
          </query>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel depends="$secondpacketsize$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$secondpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$thirdpacketsize$">
      <title>Third Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$thirdpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fourthpacketsize$">
      <title>Fourth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fourthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
    <panel depends="$fifthpacketsize$">
      <title>Fifth Panel</title>
      <table>
        <search>
          <query>
            ``` Query to generate results based on packet size ```
            | makeresults
            | eval packetsize="$fifthpacketsize$"
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

[Jouman]

thank you so much. This works!

[isoutamo]

Hi

You should use that filter search for generate selection list. Here is couple of old answers:

• https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-dynamic-selection-of-sourc...
• https://community.splunk.com/t5/Splunk-Search/How-to-set-token-value-based-on-selection-from-multise...

You could find more information from Splunk visualisation documentations.

r. Ismo