Dashboards & Visualizations

How to show/hide panels on dashboard based on multi select drop down values

aditsss
Motivator

Hi Everyone,

I have requirement like this:

I have one multi select drop-down which consists of 20+ values.Below is the code for the multi-select drop down

<input type="multiselect" token="name" searchWhenChanged="true">
<label> Name</label>
<choice value="*">All Name</choice>
<search>
<query>|inputlookup abc.csv|table FolderName</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<fieldForLabel>FolderName</fieldForLabel>
<fieldForValue>FolderName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>FolderName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

I have one dashboard which consists of 20 panels in a form of rows.

I want when I select value from multi select drop down say "Force" then "Force" panel should show and rest  panels should hide. If I select "Merchant" from multi select drop-down then "Merchant" panel should show  and rest panels should hide.

I have already pass the multi select drop down token "name" in each panel.

How can I achieve hide/show of panels.

Below is my xml:

<form theme="dark">
<label>Report</label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="name" searchWhenChanged="true">
<label> Name</label>
<choice value="*">All Name</choice>
<search>
<query>|inputlookup abc.csv|table FolderName</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<fieldForLabel>FolderName</fieldForLabel>
<fieldForValue>FolderName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>FolderName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title> Report for Force</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=force $name$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">FolderName</option>
</chart>
</panel>
</row>
<row>
<panel>
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=merchant $name$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">FolderName</option>
</chart>
</panel>
</row>
<row>
<panel>
<title> Report for One</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=one $name$</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">FolderName</option>
</chart>
</panel>
</row>
<row>
<panel>
<title> Report for CP</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=cp $name$</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">FolderName</option>
</chart>
</panel>
</row>
..........
..........
..........
..........
..........
..........
..........
............
.............
.............
...................
.....................
</form>

Can someone guide me on this.

Thanks in advance.

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Hi @aditsss 

Now you need to build your choice of panels into a selection string for the summary query. Add these lines in the multiselect panel before the default e.g.

...
        <prefix>(</prefix>
        <valuePrefix>OrgFolderName ="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <suffix>)</suffix>
        <default>All</default>
...

and add another eval at the end of the change e.g.

...
          <eval token="org_choice">if(mvfind('form.Org',"All")=0,"OrgFolderName!=imhe_b",$Org$)</eval>
        </change>
...

Finally, modify the query for the summary panel

...
<query>index=abc sourcetype="xyz" $org_choice$ (BuildResult=SUCCESS) 
...

I noticed that you still have $Org$ at the end of your other queries - this should be removed as it will affect the results of these queries.

View solution in original post

niketn
Legend

@aditsss please try one of my older answers which uses check boxes to show hide Check Boxes using independent search which processes the selection from check box input and sets/unsets required tokens accordingly. You can extend the same to convert to Multi-Select and Panels instead of Check Boxes and Inputs. The same concept should work for both. You should also be able to handle all scenario using SPL.

https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-hide-unhide-specific-text-boxes-usin...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Nisha18789
Builder

Hi @aditsss , you can use tokens for this, below might not be the best way to do it, but it will work for the multiselect dropdown

Assuming you have 20 values in the multiselect dropdown, for each value in the dropdown  create tokens in init

<init>

<set token="matcher1">Force</set>
<set token="matcher2">Merchant</set>

.

.

.

</init>

Then, in the multiselct dropdown input, write condition as 

<input type="multiselect" token="name" searchWhenChanged="true">
<label> Name</label>
<choice value="*">All Name</choice>
<search>
<query>|inputlookup abc.csv|table FolderName</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<fieldForLabel>FolderName</fieldForLabel>
<fieldForValue>FolderName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>FolderName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>

<change>
<condition match="match($name$,$matcher1$">
<set token="force"></set>

<unset token="merchant"></unset>

<unset token="dropdown value"></unset>

....

.... till all 19 tokens are unset for other than Force option

</condition>

<condition match="match($name$,$matcher2$">
<set token="merchant"></set>

<unset token="force"></unset>

<unset token="dropdown value"></unset>

....

.... till all 19 tokens are unset for other than Merchant option


</condition>
.....

....

.... similar condition for other dropdown options
</change>
</input>

now, in the respective panels use the respective tokens in depends like

<row depends="$force$">
<panel>
<title> Report for Force</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=force $name$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">FolderName</option>
</chart>
</panel>
</row>
<row depends="$merchant$">
<panel>
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=merchant $name$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">FolderName</option>
</chart>
</panel>
</row>

Let me know if any question.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you are hiding all but the selected item from the drop down, this doesn't sound like a multi-select

Your rows need a depends attribute, e.g.

<row depends=$show_merchant$>

The change from the dropdown can unset all the tokens apart from the token for the selected row 

0 Karma

aditsss
Motivator

Hi Nisha18789/ITWhisperer

This is not working for me. Its only taking the first value from the multiselect drop-down "AllOrgs" and its showing all panels. 

When I select value like"Merchant" from drop down . Its not showing anything.

I want if I select suppose"Merchant" and "Force" from multiselect dropdown then it should display the panels of Merchant and force and rest panels should hide.

Can someone guide me where I got wrong.Do I need to pass any other token in query. I have passed dro-down token. Why its not picking that.

Below is my code.

<form theme="dark">
<label>Build Report</label>
<init>
<set token="merchant">merchant</set>
<set token="force">force</set>
<set token="one">one</set>
<set token="force2">force2</set>
<set token="merchant2">merchant2</set>
<set token="two">two</set>
........
.............
........
</init>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label>Name</label>
<choice value="*">All Org</choice>
<search>
<query>|inputlookup abc.csv|table Name</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<fieldForLabel>Name</fieldForLabel>
<fieldForValue>Name</fieldForValue>
<prefix>(</prefix>
<valuePrefix>Name ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
<change>
<condition match="match($Org$,$merchant$">
<set token="merchant"></set>
<unset token="force">force</unset>
<unset token="one">one</unset>
<unset token="force2">force2</unset>
<unset token="merchant2">merchant2</unset>
<unset token="two">two</unset>
</condition>
<condition match="match($Org$,$force$">
<unset token="merchant"></unset>
<set token="force">force</set>
<unset token="one">one</unset>
<unset token="force2">force2</unset>
<unset token="merchant2">merchant2</unset>
<unset token="two">two</unset>
</condition>
</change>
</input>
<row depends="$merchant$">
<panel>
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=mf $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">Name</option>
</chart>
</panel>
</row>
<row depends="$force$">
<panel>
<title> Report for Force</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" FolderName=force $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="trellis.splitBy">Name</option>
</chart>
</panel>
</row>
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@aditsss OK Thanks for clarifying the requirement. Try something like this (now with All option):

 

...
  <row>
    <panel>
      <input type="multiselect" token="panels">
        <label>Select one or more panels</label>
        <choice value="All">All</choice>
        <choice value="merchant">merchant</choice>
        <choice value="force">force</choice>
        <choice value="one">one</choice>
        <choice value="force2">force2</choice>
...
        <default>All</default>
        <change>
          <eval token="form.panels">case(mvcount('form.panels')=0,"All",mvcount('form.panels')&gt;1 AND mvfind('form.panels',"All")&gt;0,"All",mvcount('form.panels')&gt;1 AND mvfind('form.panels',"All")=0,mvfilter('form.panels'!="All"),1==1,'form.panels')</eval>
          <eval token="merchant">if(isnull(mvfind('form.panels',"merchant")),mvfind('form.panels',"All"),1)</eval>
          <eval token="force">if(isnull(mvfind('form.panels',"force")),mvfind('form.panels',"All"),1)</eval>
          <eval token="one">if(isnull(mvfind('form.panels',"one")),mvfind('form.panels',"All"),1)</eval>
          <eval token="force2">if(isnull(mvfind('form.panels',"force2")),mvfind('form.panels',"All"),1)</eval>
...
        </change>
      </input>
    </panel>
  </row>
...
  <panel depends="$merchant$">
...
  <panel depends="$force$">
...

 

Things to note: the evals have to be on single lines (no line breaks); the first eval  removes "All" if anything else is selected, and adds it if nothing is selected; it doesn't matter what the token is set to so I am setting them to 1 (or null if not selected); setting a token to null is the same as unsetting it.

0 Karma

aditsss
Motivator

Hi ITWhisperer,

Its again not working for me. Not displaying anything on the dashboard.

Below is my code. Please guide me where I go wrong.

Thanks in advance.

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org">
<label> Org Name</label>
<choice value="*">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<initialValue>*</initialValue>
<default>*</default>
<eval token="form.Org">case(mvcount('form.Org')=0,"*",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"*")&gt;0,"*",mvcount('form.Org')&gt;1 AND
mvfi('form.Org',"*")=0,mvfilter('form.Org'!="*"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"*"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"*"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"*"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"*"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"*"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',gcpi")),mvfind('form.Org',"*"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"*"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"*"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"*"),1)</eval>
.......
.......
.......
........
</fieldset>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than using "*" for "All Org" try using "All" as in my suggestion, then when you try to find it you are not looking for a wildcard.

Also, gcpi is missing a leading double quote in the mvfind

0 Karma

aditsss
Motivator

Hi ITWhisperer,

I tried by adding"All" instead of "*". The dashboard is not displaying anything when"All Orgs" is coming in the drop-down by default when we loaded the dashboard for the first time. Also the multi select conditions are not working properly. Its like when I select "merchant" from the drop down then merchant panel is coming with data and then when I select force with merchant then only Force panel data is coming merchant data is not coming. Also when I cross one value out of two say I cross Force from force and merchant in multiselect in that case also both force and merchant panels are displaying. Again when I am selecting "All Orgs" then also data of first panel is displaying not all panels. Can you guide me where its going wrong. Below is my code

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label> Org Name</label>
<choice value="All">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<initialValue>All</initialValue>
<default>All</default>
<eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfi('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval>
.......
.......
.......
........
</input>
<input type="time" token="field4" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</fieldset>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Al the evals need to be in a change clause

...
<default>All</default>
<change>
  <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
...

 

0 Karma

aditsss
Motivator

Hi ITWhisperer,

All the evals are under change clause but still same issue is arriving.

Below is the code:

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label> Org Name</label>
<choice value="All">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfi('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval>
.......
.......
.......
........
</change>
</input>
<input type="time" token="field4" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</fieldset>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
mvfi('form.Org',"All")

needs to be

mvfind('form.Org',"All")
0 Karma

aditsss
Motivator

Hi ITWhisperer,

I changed it to mvfind.  The issue is when dashboard is first loaded with All Orgs as default  Its showing all panels but data for first panel only and that too wrong data.(I am selecting past 30 days its showing of yesterday)

Also again there is issue with multiselect. When I select "Merchant" from multiselect then its showing data for merchant correct and then I select "Force" with merchant then its not showing data for  both Force  and merchant

Also I am not able to select "AllOrgs" with individual values from multiselect.Also when I cross one value out of two say I cross Force from force and merchant in multiselect in that case also both force and merchant panels are displaying. Again when I am selecting "All Orgs" then also data of first panel is displaying not all panels.

Below is my code:

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label> Org Name</label>
<choice value="All">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval>
.......
.......
.......
........
</change>
</input>
<input type="time" token="field4" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</fieldset>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is $Org$ doing at the end of the panel queries?

<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$

$Org$ has already been used to select which panels to show. It probably doesn't have a valid value for the queries. You already have OrgFolderName=merchant in the merchant panel 

0 Karma

aditsss
Motivator

Hi ITWhisperer,

Thank you so much for your help. I am new to splunk and its really helping me to learn splunk.

I have one issue rest all issues are resolved. Out of 20 panels I have one panel as summary panel.

Its like when I select "Merchant" from multi-select dropdown then summary tab should show summary of merchant for whatever time I selected(suppose 30 days) along with merchant individual tab.

when I select "Force" and "Merchant" then total 3 panels should be displayed one summary showing summary to show the summary of "Force" and "Merchant" along with Force and Merchant individual tabs.

Individual panels are working properly by the code you provided me. Can you please guide me on this.

What token I should pass in summary panel to make it work.

Below is my code:

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label> Org Name</label>
<choice value="All">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval>
.......
.......
.......
........
</change>
</input>
<input type="time" token="field4" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</fieldset>
<panel>
<title>Summary of Average Build Times of all orgs over the selected time period.</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" (OrgFolderName!=imhe_b ) (BuildResult=SUCCESS) | eval BuildDurationInMinutes=round(BuildDuration/40000,1) | chart avg(BuildDurationInMinutes) as AverageBuildDurationInMinutes over OrgFolderName limit=40 | sort -AverageBuildDurationInMinutes</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Org</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Average Build Duration In Minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @aditsss 

Now you need to build your choice of panels into a selection string for the summary query. Add these lines in the multiselect panel before the default e.g.

...
        <prefix>(</prefix>
        <valuePrefix>OrgFolderName ="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <suffix>)</suffix>
        <default>All</default>
...

and add another eval at the end of the change e.g.

...
          <eval token="org_choice">if(mvfind('form.Org',"All")=0,"OrgFolderName!=imhe_b",$Org$)</eval>
        </change>
...

Finally, modify the query for the summary panel

...
<query>index=abc sourcetype="xyz" $org_choice$ (BuildResult=SUCCESS) 
...

I noticed that you still have $Org$ at the end of your other queries - this should be removed as it will affect the results of these queries.

aditsss
Motivator

Hi ITWhisperer,

Is  something like this I need to do for summary tab. Can you please confirm.

Below is my code:

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label> Org Name</label>
<choice value="All">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<prefix>(</prefix>
<valuePrefix>OrgFolderName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval>
<eval token="org_choice">if(mvfind('form.Org',"All")=0,"OrgFolderName!=imhe_b AND OrgFolderName!=imhe_e",$Org$)</eval>
.......
.......
.......
........
</change>
</input>
<input type="time" token="field4" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</fieldset>
<panel>
<title>Summary of Average Build Times of all orgs over the selected time period.</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" (OrgFolderName!=imh_b AND OrgFolderName!=imhe_e) (BuildResult=SUCCESS) $org_choice$ | eval BuildDurationInMinutes=round(BuildDuration/40000,1) | chart avg(BuildDurationInMinutes) as AverageBuildDurationInMinutes over OrgFolderName limit=40 | sort -AverageBuildDurationInMinutes</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Org</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Average Build Duration In Minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

0 Karma

aditsss
Motivator

Hi ITWhisperer,

This is really helpful. 

Just one suggestion needed . Can we use lookup table for drop-down values instead of hard coding the values as they are 30+ and may increase in future.

Can you guide me on that.

Below is the code for drop-down inputlookup:

<input type="multiselect" token="name" searchWhenChanged="true">
<label> Name</label>
<choice value="*">All Name</choice>
<search>
<query>|inputlookup abc.csv|table FolderName</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<fieldForLabel>FolderName</fieldForLabel>
<fieldForValue>FolderName</fieldForValue>
<prefix>(</prefix>
<valuePrefix>FolderName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

 

The code that I am using currently with hard-coded values:

<form theme="dark">
<label> Build Report </label>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="Org" searchWhenChanged="true">
<label> Org Name</label>
<choice value="All">All Org</choice>
<choice value="accert">accert</choice>
<choice value="atj">atj</choice>
<choice value="force">force</choice>
<choice value="merchant">merchant</choice>
<choice value="control">control</choice>
<choice value="gcpi">gcpi</choice>
<choice value="ppp">ppp</choice>
<choice value="theforce">theforce</choice>
<choice value="gpof">gpof</choice>
<choice value="hkin">hkin</choice>
<choice value="ihh">ihh</choice>
.......
........
.......
<prefix>(</prefix>
<valuePrefix>OrgFolderName ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND
mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval>
<eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval>
<eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval>
<eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval>
<eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval>
<eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval>
<eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval>
<eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval>
<eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval>
<eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval>
<eval token="org_choice">if(mvfind('form.Org',"All")=0,"(OrgFolderName!=imhe_b AND OrgFolderName!=imhe_e",$Org$)"</eval>
.......
.......
.......
........
</change>
</input>
<input type="time" token="field4" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</fieldset>
<panel>
<title>Summary of Average Build Times of all orgs over the selected time period.</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" (BuildResult=SUCCESS) $org_choice$ | eval BuildDurationInMinutes=round(BuildDuration/40000,1) | chart avg(BuildDurationInMinutes) as AverageBuildDurationInMinutes over OrgFolderName limit=40 | sort -AverageBuildDurationInMinutes</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Org</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Average Build Duration In Minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<row>
<panel depends="$merchant$">
<title> Report for Merchant</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS </query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
<panel depends="$accert$">
<title> Report for accert</title>
<chart>
<search>
<query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">BuildDuration in minutes</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
</chart>
</panel>
</row>
........
.........
.........
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure whether the benefit would be significant since you are still going to have to hard code the change section to set the different tokens and hard code the panels to depend on these tokens.

An option might be to write a script to generate the source for the dashboard, but you would have to re-run the script and copy/paste the results into the dashboard each time it changed. Again, possibly of limited benefit unless you are expecting a high volume of change.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...