How to get conditional display of panels driven by...

gabriel_vasseur · ‎09-19-2016

Variations of this questions have been asked many times but so far none of what I've seen has helped me. That's why I need your wisdom.

I have a form with 2 text fields and a check box. I want a panel to appear if the check box is ticked and the text fields are both left to their default value '*'. This is because the check box makes the search use a transaction and if none of the text fields are populated, it's going to have to work on possibly a huge amount of data. If that happens, I want a panel to appear to warn the user.

<fieldset submitButton="true" autoRun="false">
  <input type="text" token="user_token" searchWhenChanged="false">
    <label>user</label>
    <default>*</default>
    <initialValue>*</initialValue>
  </input>
  <input type="text" token="host_token" searchWhenChanged="false">
    <label>host</label>
    <default>*</default>
    <initialValue>*</initialValue>
  </input>
  <input type="checkbox" token="transaction_token" searchWhenChanged="false">
    <label>Transaction</label>
    <choice value="| transaction session_id">Transaction</choice>
    <default></default>
  </input>
</fieldset>

To start small, I have tried this:

<row>
  <panel depends="$transaction_token$">
    <html>
      <b>Warning</b> blah blah blah
    </html>
  </panel>
</row>

But this displays the panel as soon as I press the submit button, whether or not I have ticked the box.

So then I tried something like:

<input type="checkbox" token="transaction_token" searchWhenChanged="false">
  <label>Transaction</label>
  <choice value="| transaction session_id">Transaction</choice>
  <default></default>
  <change>
    <condition match="isnull($transaction_token$) OR $transaction_token$==&quot;&quot;">
      <set token="using_transactions_token">NOTRANSACTION</set>
    </condition>
    <condition>
      <unset token="using_transactions_token"/>
    </condition>
  </change>
</input>

And that almost works but it's erratic just like a previous question I asked a while ago. So I thought the fix would be similar and I did:

<input type="checkbox" token="transaction_token" searchWhenChanged="false">
  <label>Transaction</label>
  <choice value="| transaction session_id">Transaction</choice>
  <default></default>
  <change>
    <condition match="isnull($value$) OR $value$==&quot;&quot;">
      <set token="using_transactions_token">NOTRANSACTION</set>
    </condition>
    <condition>
      <unset token="using_transactions_token"/>
    </condition>
  </change>
</input>

But that does not work. I even tried value instead of $value$ like I've seen in some other answers here, but to no avail. That is my first hurdle. Once I get that working, I'll then need something similar for the text fields (I think that should be easier) and then I need to get something like this to work:

<row>
  <panel depends="$using_transaction_token$ AND $default_user$ AND $default_host$">
    <html>
      <b>Warning</b> blah blah blah
    </html>
  </panel>
</row>

I'm not even sure if ANDing depends is possible and, if it is, how to do it.

Beyond helping me with that particular problem, I would be grateful if someone could also advise me on where I can get proper information on how these things work. Searching splunk answers yields the occasional gem, but more often than not it goes in many directions that are not my exact problem. I had a look at the docs but they barely scratch the surface of what's possible. So any good resource pointer would be great. Give a man a fish versus teach a man to fish, etc...

If that's relevant: I'm on 6.4.

sundareshr · ‎09-19-2016

The one change would be to flip your logic. So here's how depends and/or rejects works. If the token is set (irrespective the value in the token), the panel with depends will show, and reject will hide. For example <set token=sometoken></set> will also be considered as a valid token. unset is the only way to remove the token. In your example, you have

if  isnull($value$) then set

even though the values is NOTTRANSACTION, depends sees the token is set, and will show the panel. Instead, change to

if  isnull($value$) then unset else set

You can use multiple tokens in your depends (remember, if you use set token gets set, regardless of value). Although, not sure if you need to explicitly state AND. I know tokOne, tokTwo, tokThree means all three tokens have to be set for the panel to show.

Now, instead of unset, you could also use rejects to hide panels. Just a thought.

gabriel_vasseur · ‎09-20-2016

Thanks, that will be useful once I've past the first hurdle, which is to get a token to be set/unset when the check box is ticked. As I said in my question, the following doesn't work (the token is always set to NOTRANSACTION, presumably because $value$ is not the right thing to be looking at...):

   <change>
     <condition match="isnull($value$) OR $value$==&quot;&quot;">
       <set token="using_transactions_token">NOTRANSACTION</set>
     </condition>
     <condition>
       <unset token="using_transactions_token"/>
     </condition>
   </change>

Any suggestions about this?

sundareshr · ‎09-20-2016

The token is set when checkbox is checked and unset when unchecked, so do you need the conditional set?

gabriel_vasseur · ‎09-21-2016

I'm not sure what you mean, but $transaction_token$ gets set as soon as I hit the submit button, whether or not the checkbox is ticked. Whatever happens, it is never unset after that. That's why I think I need $using_transactions_token$ , but I just can't get that to work.

sundareshr · ‎09-21-2016

So I created a simple test RA dashboard with a submit button. I don't see the behavior you are seeing. What am I missing?

<form>
  <label>test</label>
  <fieldset submitButton="true">
    <input type="checkbox" token="tokChk">
      <label>Check</label>
      <choice value="checked">Checked</choice>
    </input>
    <input type="text" token="field1"></input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Checked: $tokChk$</title>
        <search>
          <query>| makeresults | eval val=if(len("$tokChk$")=0, "unchecked", "checked") | eval val=val." (".len("$tokChk$").")"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="mapping.type">marker</option>
      </single>
    </panel>
  </row>
</form>

gabriel_vasseur · ‎09-22-2016

Thanks Sundaresh, I do appreciate your spending your time on my issue. I have added the following to your example:

<row>
  <panel depends="$tokChk$">
    <html>
      <h1>Hello World!</h1>
    </html>
  </panel>
</row>

And it worked as intended: the panel is only displayed if the checkbox is ticked. However, one thing doesn't work as needed, and that's if the checkbox is not ticked, the search doesn't run at all. It just says "Search is waiting for input...". The fix for that is to specify either <default></default> or <initialValue></initialValue> in the checkbox definition. If I do that, the search works well whether the box is ticked or not, but now the problem is that the panel that depends on $tokChk$ is now displayed all the time.

That's why in my original post I was trying to solve that problem by using another token...

How to get conditional display of panels driven by form tokens

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

Transform your security operations with Splunk Enterprise Security

Splunk Admins and App Developers | Earn a $35 gift card!