Dashboards & Visualizations

How to make a panel clickable to enable or disable tokens from a SimpleXML dashboard?

marxsabandana
Path Finder

Is there a way to make a panel clickable as if it is a button? I'm trying to figure this out to enable or disable multiple sets of panels using tokens.

 

For example, if I'm going to click Panel 1, four panels will show up. Then if I'm going to click Panel 2, the four panels for Panel 1 will be hidden, and the panels for Panel 2 will now be visible. Thanks!

Labels (5)
0 Karma

marxsabandana
Path Finder

Hi, this is really helpful. Thank you!

Can the drilldown $click.value$ be applied on the panel itself, and not on the single value viz?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can use panel drilldown

Here is a run anywhere example with nested drilldown

Clicking on 'a' will display a set of panels and 'b' will display another set of panels for e.g.

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval a="a"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="showSparkline">0</option>
        <drilldown>
          <set token="a">$click.value$</set>
          <unset token="b"></unset>
          <unset token="c"></unset>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval b="b"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="b">$click.value$</set>
          <unset token="c"></unset>
          <unset token="a"></unset>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval c="c"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="c">$click.value$</set>
          <unset token="b"></unset>
          <unset token="a"></unset>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$a$">
      <single>
        <search>
          <query>|makeresults|eval d="d"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="d">$click.value$</set>
          <unset token="e"></unset>
          <unset token="f"></unset>
        </drilldown>
      </single>
    </panel>
    <panel depends="$a$">
      <single>
        <search>
          <query>|makeresults|eval e="e"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="e">$click.value$</set>
          <unset token="d"></unset>
          <unset token="f"></unset>          
        </drilldown>
      </single>
    </panel>
    <panel depends="$a$">
      <single>
        <search>
          <query>|makeresults|eval f="f"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="f">$click.value$</set>
          <unset token="e"></unset>
          <unset token="d"></unset>          
        </drilldown>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>|makeresults|eval g="g"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>|makeresults|eval h="h"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>|makeresults|eval i="i"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$d$">
      <table>
        <search>
          <query>index=_internal|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

 

 

 

Happy Splunking!
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...