How to hide panel until pan and zoom range is sele...

eggsu · ‎10-05-2020

Hi,

One of my panel's is based off the start and end token of a pan and zoom selection (like the example shown).

However without any user selection, I want to hide the 2nd panel until the user has decided to select a pan and zoom time range.

I have tried doing depends="$selection.earliest$" in the 2nd panel's xml but it doesn't seem to work. How do i go about this?

Thanks!

ITWhisperer · ‎10-06-2020

First thing to do is unset the token which controls the display of the panel in your init block:

  <init>
    <unset token="panel_start_time"></unset>
  </init>

Next, in the search for the first panel, add a done block and set tokens when the search completes:

          <done>
            <eval token="earliestTime">if($job.isDone$,strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%Q%z"),null())</eval>
            <eval token="latestTime">if($job.isDone$,relative_time(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%Q%z")-1,"@h"),null())</eval>
          </done>
        </search>

The job.earliest and job.latest are in local time format including timezone offset. You may need to adjust these format strings to match. Also, because my first panel search is bin'd and snapped to the hour, the job.latestTime is the end of the hour, whereas I actually need the beginning of the last hour for the subsequent search (hence -1 (second) and resnap (@h)). You may need to adjust this to your needs.

Next, add a selection block to the first panel to capture the selection start and finish:

        <selection>
          <eval token="panel_start_time">if($start$=$earliestTime$ AND $end$=$latestTime$,null(),$start$)</eval>
          <eval token="panel_end_time">$end$</eval>
        </selection>
      </chart>

If selection start is equal to earliestTime (as previously calculated) and selection end is equal to latestTime (as previously calculated), there is no selection currently active; setting the token to null() is equivalent to unset.

In your second panel, set it to display if the panel_start_time is set (you could have used a different token here but you are setting up panel_start_time in the selection block anyway):

    <panel depends="$panel_start_time$">
      <chart>

Finally, set the time period for your search in the second panel:

          <earliest>$panel_start_time$</earliest>
          <latest>$panel_end_time$</latest>
        </search>

eggsu · ‎10-07-2020

Hi thanks for your help!! I just have 1 issue right now. I don't think my $job.latestTime$ token is setting a time value at all. I printed it out in the HTML panel just to check what it looked like:

    <done>
              <eval token="check">$job.latestTime$</eval>
    </done>

Printing the token out gave me $check$ as the output in the panel. However when I did the same thing with $job.earliestTime$, this printed out a time value (but doesn't seem to be the right start time of the chart)

Why might this be?

ITWhisperer · ‎10-07-2020

What is the value of check that you are seeing?

eggsu · ‎10-11-2020

The output looks like this.
The corresponding HTML XML is:

Where $check$ is:

           <eval token="check">$job.latestTime$</eval>

      <html>
      $check$
      <br/>
      $earliestTime$
      <br/>
      $latestTime$
      </html>

ITWhisperer · ‎10-12-2020

Try this

<done>
  <eval token="check">if($job.isDone$,$job.latestTime$,"Not finished")</eval>
</done>

eggsu · ‎10-12-2020

I tried that too and the same problem occurs. I even tried doing this:

  <done>
<eval token="checkTime">if($job.isDone$,$job.latestTime$,"Not finished")</eval>
<eval token="checkTime2">if($job.isDone$,$job.earliestTime$,"Not finished")</eval>
</done>

This resulted in the following output:

ITWhisperer · ‎10-13-2020

Which version of splunk are you using as this works. You may need to raise a support call with splunk.

How to hide panel until pan and zoom range is selected?

chart

Introducing the Splunk Community Dashboard Challenge!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...