Dashboards & Visualizations

How to set token from search and then conditionally show a panel if token condition matches?

mjon395
Explorer

Hello,

I'm working on showing a panel if the $env:user$ is a match based on a search.

The search that I'm using works for this use case:

 

| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id

 

This retrieves the appropriate ID (otherwise, I would just use the $evn:user$ for conditional visibility, but this never works).

With the query result, I set a token envid to $result.id$

I then do a condition match where $envid$==uu_33 (uu_33 represents the user ID required to display a panel).

The result of the query is always correct with "uu_33", which matches the condition I have written.

I have tried following the splunk guides, and I have tried the following condition matches:

  1. <condition match="'$envid$'==&quot;uu_33&quot;"> (current)
  2. <condition match="$envid$==&quot;uu_33&quot;">
  3. <condition match="'$envid$'==uu_33">
  4. <condition match="$envid$==uu_33">

Nothing makes the panel show.

Here is my XML.  Any help would be appreciated.

 

<dashboard>
  <label>testenvid</label>
  <row>
    <panel>
      <html>
        <b>hi.  your current id is $env:user$.  The current result is $envid$ is set to be equal to $result.id$.</b>
      </html>
    </panel>
    <panel depends="$showpanel$">
      <table>
        <search>
          <finalized>
            <set token="envid">$result.id$</set>
          </finalized>
          <done>
            <condition match="'$envid$'==&quot;uu_33&quot;">
              <set token="showpanel">TRUE</set>
            </condition>
          </done>
          <query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

    <panel depends="$showpanel$">
      <table>
        <title>$showpanel$</title>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| makeresults
| eval user=$env:user|s$</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

    <panel depends="$showpanel$">
      <table>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($env:user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
0 Karma

mjon395
Explorer

Hmm, no luck with that either.  showpanel is actually setting to null instead of true, which seems like evn:user isn't passing, but the simple html debug shows the id as being fine.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

    <panel depends="$showpanel$">
      <table>
        <title>$showpanel$</title>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| makeresults
| eval user=$env:user|s$</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
0 Karma

mjon395
Explorer

Perfect!  That worked.  Did a quick check with both invalid and valid IDs and the expected result occurred.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...