Dashboards & Visualizations

How to make a panel clickable to enable or disable tokens from a SimpleXML dashboard?

marxsabandana
Path Finder

Is there a way to make a panel clickable as if it is a button? I'm trying to figure this out to enable or disable multiple sets of panels using tokens.

 

For example, if I'm going to click Panel 1, four panels will show up. Then if I'm going to click Panel 2, the four panels for Panel 1 will be hidden, and the panels for Panel 2 will now be visible. Thanks!

Labels (5)
0 Karma

marxsabandana
Path Finder

Hi, this is really helpful. Thank you!

Can the drilldown $click.value$ be applied on the panel itself, and not on the single value viz?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can use panel drilldown

Here is a run anywhere example with nested drilldown

Clicking on 'a' will display a set of panels and 'b' will display another set of panels for e.g.

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval a="a"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="showSparkline">0</option>
        <drilldown>
          <set token="a">$click.value$</set>
          <unset token="b"></unset>
          <unset token="c"></unset>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval b="b"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="b">$click.value$</set>
          <unset token="c"></unset>
          <unset token="a"></unset>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single>
        <search>
          <query>|makeresults|eval c="c"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="c">$click.value$</set>
          <unset token="b"></unset>
          <unset token="a"></unset>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$a$">
      <single>
        <search>
          <query>|makeresults|eval d="d"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="d">$click.value$</set>
          <unset token="e"></unset>
          <unset token="f"></unset>
        </drilldown>
      </single>
    </panel>
    <panel depends="$a$">
      <single>
        <search>
          <query>|makeresults|eval e="e"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="e">$click.value$</set>
          <unset token="d"></unset>
          <unset token="f"></unset>          
        </drilldown>
      </single>
    </panel>
    <panel depends="$a$">
      <single>
        <search>
          <query>|makeresults|eval f="f"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="f">$click.value$</set>
          <unset token="e"></unset>
          <unset token="d"></unset>          
        </drilldown>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>|makeresults|eval g="g"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>|makeresults|eval h="h"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>|makeresults|eval i="i"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$d$">
      <table>
        <search>
          <query>index=_internal|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

 

 

 

Happy Splunking!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...