Dashboards & Visualizations

How to set tokens for checkboxes using Simple XML where unchecking a box causes certain charts to disappear in Splunk 6.2.2?

rjthibod
Champion

In a Simple XML form (Splunk 6.2.2), I am trying to set tokens based on if a checkbox is unchecked/deselected. Can the change & condition elements of Simple XML do this? Basically, I want to have three checkboxes, and each box controls what charts appear on the form. If a checkbox is deselected at any time, I want certain charts to disappear.

0 Karma
1 Solution

rjthibod
Champion

This is only possible in SimpleXML for the scenario described by @somesoni2 (why I upvoted his answer). The complete answer is this is not possible in SimpleXML when you want to set multiple checkboxes or multiple tokens in a single group of checkbox options. You can only do it via custom Javascript extensions.

View solution in original post

0 Karma

rjthibod
Champion

This is only possible in SimpleXML for the scenario described by @somesoni2 (why I upvoted his answer). The complete answer is this is not possible in SimpleXML when you want to set multiple checkboxes or multiple tokens in a single group of checkbox options. You can only do it via custom Javascript extensions.

0 Karma

somesoni2
Revered Legend

Here you go

<form>
  <label>Show Hide Using checkbox</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="sourcetypetable" searchWhenChanged="true">
      <label>Select Charts</label>
      <choice value="sourcetype">Show Sourcetype Count</choice>
    </input>
    <input type="checkbox" token="hosttable" searchWhenChanged="true">
      <label>Select Charts</label>
      <choice value="host">Show Host Count</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table depends="$sourcetypetable$">
        <search>
          <query>index=_internal | stats c by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
    <panel>
      <table depends="$hosttable$">
        <search>
          <query>index=_internal | stats c by host</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

BLACKBEARCO
Explorer

I know this is old but @somesoni2's solution works like a dream. To put the cherry on top, if you want to also prevent the search from running in the background, we ended up going this route:

<fieldset submitButton="false">
    <input type="checkbox" token="first_token" searchWhenChanged="true">
      <label>Generic Label Here</label>
      <choice value="True">First Checkbox</choice>
    </input>
    <input type="checkbox" token="second_token" searchWhenChanged="true">
      <label></label>
      <choice value="True">Second Checkbox</choice>
    </input>
...
</fieldset>
<row depends="$first_token$">
    <panel>
      <table>
        <search depends="$first_token$">
          <query>...</query>
          <earliest>...</earliest>
          <latest>...</latest>
        </search>
      </table>
    </panel>
</row>
<row depends="$second_token$">
    <panel>
      <table>
        <search depends="$second_token$">
          <query>...</query>
          <earliest>...</earliest>
          <latest>...</latest>
        </search>
      </table>
    </panel>
</row>
...​

This allows us to both dynamically select which "sections" of dashboards to load and the queries will not run until the panels are displayed as well, which cuts down on query run time for any given section, especially for complex dashboards.

 

 

robertlynch2020
Motivator

Hi - Thanks for above, i am going to use this. I was wondering to make it cleaner can i just put in one checkbox with multiple choices.

This is one way

  <choice value="CPU">CPU</choice>
</input>
<input type="checkbox" token="CPU_GRAPH_ON_OFF2" searchWhenChanged="true">
  <choice value="CPU2">CPU2</choice>
</input>

Ideally i want this, as i want to select to turn off multiple graphs from one checkbox

CPU
CPU2

But when i reference this it takes the first
for one table and
for another table

0 Karma

rjthibod
Champion

I think both answers above are viable as workaround, but I would really like to know if this is possible with one input element, of type checkbox. Can someone from the Splunk team confirm if the change/condition elements can distinguish between checking and unchecking a box, thereby allowing set and unset elements to be used?

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

It's certainly possible with a JS extension to the dashboard. In that case you'd listen to the value of the checkbox token changing, and then use JQuery to hide/show panels as appropriate.

As for whether you can do it purely through Simple XML with no JS, I'm not sure.

rjthibod
Champion

My experience thus far says you are correct.

0 Karma

Patient
Path Finder

Hi rjthibod,

I don't know if this will help you.
It's possible:
1. You need to run the Search String to populate each box and probably filter the value of one or two other box with token of the first.
2. Then provide the Token from latest box to filter the search which populate the form.

Sorry for my english level. Thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...