How to hide single value panel based on a drop-down condition?

[vikas_gopal]

Hi Experts,

I am using Splunk 6.5.0 and i checked Splunk Universal Hide-Show Objects example . This is exactly I am looking but for me it is not working fine. Panel should only visible if except all anything selected in the dropdown box

my code is

Filters

  <input type="dropdown" token="source" searchWhenChanged="true">
        <label>Select a Sourcetype:</label>
        <prefix>sourcetype="</prefix>
        <choice value="All">All</choice>
     <change>
      <condition value="All">
        <set token="showMoreOptions">true</set>
      </condition>
      <condition value="*">
        <unset token="showMoreOptions"/>
      </condition>
    </change>
        <fieldForLabel>sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
        <search>
            <query>index=_internal | stats count by sourcetype</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
        </search>
    </input>



    <panel depends="$showMoreOptions$">

        <!-- 2 elements are grouped into 1 column -->
        <single>

            <title>Single panel 1</title>
            <search>
                <query>index=_internal earliest=-h | stats count</query>
            </search>
            <option name="unit">events</option>
            <option name="unitPosition">after</option>
            <option name="underLabel">events in the past hour</option>
            <option name="field">count</option>
            <drilldown>
                <link>/app/simple_xml_examples/search?q=index=_internal earliest=-h | stats count</link>
            </drilldown>
        </single>

    </panel>

</row>

For me it is doing opposite, when i select All it shows panel but on value it hides. I want opposite of this

Please help

Thanks
VG

[niketn · Accepted solution]

Use the following sample, which uses condition match case to identify whenever * is selected from dropdown. By Default the drilldown value is all (*). This example will show Pie Chart when All is selected using chart depends and single value when a single sourcetype is selected using chart rejects.

PS: You should use match case with "*" instead of "*"

<form>
        <label>Splunk Answers Switch between Chart types based on Drop Down Value</label>
        <fieldset submitButton="false">
        <input type="dropdown" token="selSourceType" searchWhenChanged="true">
          <label>Select Source Type</label>
          <choice value="*">All</choice>
          <search>
            <query>index=_internal earliest=-15m latest=now | dedup sourcetype| sort sourcetype | table sourcetype</query>
          </search>
          <fieldForLabel>sourcetype</fieldForLabel>
          <fieldForValue>sourcetype</fieldForValue>
          <change>
            <condition match="$value$==&quot;*&quot;">
              <set token="show_piechart">true</set>
            </condition>
            <condition>
              <unset token="show_piechart"></unset>
            </condition>
          </change>
          <default>*</default>
        </input>
      </fieldset>
      <row>
        <panel>
          <!-- All sourcetypes selected: Show Pie Chart-->
          <chart depends="$show_piechart$">
            <search>
              <query>index=_internal sourcetype="$selSourceType$" | stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisX.scale">linear</option>
            <option name="charting.axisY.scale">linear</option>
            <option name="charting.axisY2.enabled">0</option>
            <option name="charting.axisY2.scale">inherit</option>
            <option name="charting.chart">pie</option>
            <option name="charting.chart.bubbleMaximumSize">50</option>
            <option name="charting.chart.bubbleMinimumSize">10</option>
            <option name="charting.chart.bubbleSizeBy">area</option>
            <option name="charting.chart.nullValueMode">gaps</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
            <option name="charting.chart.stackMode">default</option>
            <option name="charting.chart.style">shiny</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.layout.splitSeries">0</option>
            <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
            <option name="charting.legend.placement">right</option>
          </chart>
          <!-- Only Single sourcetype Selected: Show Single Value-->
          <single rejects="$show_piechart$">
            <search>
              <query>index=_internal sourcetype="$selSourceType$" | stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
            </search>
            <option name="colorBy">value</option>
            <option name="colorMode">none</option>
            <option name="drilldown">none</option>
            <option name="numberPrecision">0</option>
            <option name="showSparkline">1</option>
            <option name="showTrendIndicator">1</option>
            <option name="trendColorInterpretation">standard</option>
            <option name="trendDisplayMode">absolute</option>
            <option name="unitPosition">after</option>
            <option name="useColors">0</option>
            <option name="useThousandSeparators">1</option>
          </single>
        </panel>
      </row>
</form>

[vikas_gopal]

Now it works, thank you @niketnilay

[rjthibod]

Change the setting on the panel to rejects

<panel rejects="$showMoreOptions$">

[vikas_gopal]

@rjthibod it works but I can see Another problem
For

<input type="dropdown" token="source" searchWhenChanged="true">
         <label>Select a Sourcetype:</label>
         <prefix>sourcetype="</prefix>
         <choice value="All">All</choice>

If I mention <choice value="*">All</choice> then it again stops working . With All option rest all panel do not show data ..

Any help on this please

Thanks
VG

[rjthibod]

Keep the first change of using rejects but update the input options to use "label" instead of "value" in the condition statements.

      <change>
       <condition label="All">
         <set token="showMoreOptions">true</set>
       </condition>
       <condition label="*">
         <unset token="showMoreOptions"/>
       </condition>
     </change>