Dashboards & Visualizations

How to set token from search and then conditionally show a panel if token condition matches?

mjon395
Explorer

Hello,

I'm working on showing a panel if the $env:user$ is a match based on a search.

The search that I'm using works for this use case:

 

| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id

 

This retrieves the appropriate ID (otherwise, I would just use the $evn:user$ for conditional visibility, but this never works).

With the query result, I set a token envid to $result.id$

I then do a condition match where $envid$==uu_33 (uu_33 represents the user ID required to display a panel).

The result of the query is always correct with "uu_33", which matches the condition I have written.

I have tried following the splunk guides, and I have tried the following condition matches:

  1. <condition match="'$envid$'==&quot;uu_33&quot;"> (current)
  2. <condition match="$envid$==&quot;uu_33&quot;">
  3. <condition match="'$envid$'==uu_33">
  4. <condition match="$envid$==uu_33">

Nothing makes the panel show.

Here is my XML.  Any help would be appreciated.

 

<dashboard>
  <label>testenvid</label>
  <row>
    <panel>
      <html>
        <b>hi.  your current id is $env:user$.  The current result is $envid$ is set to be equal to $result.id$.</b>
      </html>
    </panel>
    <panel depends="$showpanel$">
      <table>
        <search>
          <finalized>
            <set token="envid">$result.id$</set>
          </finalized>
          <done>
            <condition match="'$envid$'==&quot;uu_33&quot;">
              <set token="showpanel">TRUE</set>
            </condition>
          </done>
          <query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

    <panel depends="$showpanel$">
      <table>
        <title>$showpanel$</title>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| makeresults
| eval user=$env:user|s$</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

    <panel depends="$showpanel$">
      <table>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($env:user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
0 Karma

mjon395
Explorer

Hmm, no luck with that either.  showpanel is actually setting to null instead of true, which seems like evn:user isn't passing, but the simple html debug shows the id as being fine.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

    <panel depends="$showpanel$">
      <table>
        <title>$showpanel$</title>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| makeresults
| eval user=$env:user|s$</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
0 Karma

mjon395
Explorer

Perfect!  That worked.  Did a quick check with both invalid and valid IDs and the expected result occurred.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...