Dashboards & Visualizations

How to make a dynamic drilldown created table or panel unvisible

mnaim
Explorer

I currently have a form is simplexml with a text box and submit button. When search is run on user entered query, the user can do a dynamic drill down on the results and have a new table appear next to the original table. To achieve this, I did something like this:

<form>
  <fieldset autoRun="False" submitButton="true">
   <input type="text" token="qtoken">
  </input>
 </fieldset>
 <row>
  <panel>
   <table>
     <searchString>index=blacklists sourcetype="malicious_ip" addr=$qtoken$|table _time, sourcetype, category,notes</searchString>
     <option name="drilldown">row</option>
    <drilldown>
        <set toke="category">"$row.category$"</set>
    </drilldown>
  </table>
 </panel>
<panel>
  <table depends="$category$">
    <searchString>index=blacklists sourcetype="malicious_ip" CC="US"  addr=$category$|table _time, sourcetype, notes</searchString>
 </table>
</panel>
</row>
</form>

This work but I want to make the second table gone when a new search is ran i.e when the submitButton is clicked, unless there is a better way. Right now, I have to refresh the browser to make it disappear or do a new drilldown on the new search to have it's content replaced.

0 Karma

stephanefotso
Motivator

Add a searchWhenChanged="true" in your text box. :

<input type="text" token="qtoken" searchWhenChanged="true">
SGF
0 Karma

mnaim
Explorer

Unfortunately, adding searchWhenChanged="true" didn't change anything.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...