Dashboards & Visualizations

How to use url form parameters in section of dashboard to create tokens for panel depends?

bowesmana
SplunkTrust
SplunkTrust

I have a dashboard that has a 2 box checkbox and depending on the options set in that checkbox, I show or hide an input panel for the selected option.

So, my checkbox is managed like this

    <input type="checkbox" token="show_filters">
      <label></label>
      <choice value="a">Show Enrichment filters</choice>
      <choice value="b">Show Splunk filters</choice>
      <delimiter> </delimiter>
      <change>
        <condition match="$show_filters$ = &quot;a&quot;">
          <set token="enrich">1</set>
          <unset token="splunk"></unset>
        </condition>
        <condition match="$show_filters$ = &quot;a b&quot;">
          <set token="enrich">1</set>
          <set token="splunk">1</set>
        </condition>
        <condition match="$show_filters$ = &quot;b&quot;">
          <unset token="enrich"></unset>
          <set token="splunk">1</set>
        </condition>
        <condition match="isnull($show_filters$)">
          <unset token="enrich"></unset>
          <unset token="splunk"></unset>
        </condition>
      </change>
    </input>

then I have two input panels protected like

    <panel depends="$enrich$">
      <input...>
      </input>
    </panel>
    <panel depends="$splunk$">
      <input...>
      </input>
    </panel>

and that all works fine in the dashboard. However, when I try to pass in the relevant options from a URL I can get the checkbox parameters set correctly by passing in form.show_filters=a, but form.enrich=1 does not cause the dependent enrich panel to be shown and if I add the $enrich$ token to a panel title, it is not set.

So, I tried to make an section of the dashboard to do this with each of the 3 pairs below in turn, but none seem to work.

  <init>
    <eval token="enrich">if(match($form.show_filters$,"a"),1,)</eval>
    <eval token="splunk">if(match($form.show_filters$,"b"),1,)</eval>

    <eval token="enrich">if(match($show_filters$,"a"),1,)</eval>
    <eval token="splunk">if(match($show_filters$,"b"),1,)</eval>

    <eval token="enrich">$form.enrich$</eval>
    <eval token="splunk">$form.splunk$</eval>
  </init>

I also tried adding a base search with a finalized section to do conditional matching and token setting to no avail.

Does anyone know if this is possible?

Labels (1)
0 Karma

TheEggi98
Path Finder

I have a similar Problem.

I call a Dashboard with <URL To Dashboard>?form.dropdown1=val1&form.dropdown2=val2&form.show_panel_tok=panel1

In the called Dashboard i have

...
<init>
  <eval>token="show_panel1_tok">if($form.show_panel_tok$=="panel1",true(),null())</eval>
  <eval>token="show_panel2_tok">if($form.show_panel_tok$=="panel2",true(),null())</eval>
</init>
...
<panel depends="$show_panel1_tok$">
...
<panel depends="$show_panel2_tok$">
...

 
the dropdown inputs dropdown1 and dropdown2 are showing the given value, but the evaluated tokens from init do sometimes work but mostly dont.
Could it be a timing problem of splunk? If yes does anyone know a workaround?

0 Karma

tomawest
Path Finder

I think this is similar to issues I have experienced in the past. Try adding a default value for your show_filters input. Your trigger points are based on a change in value, however you arent actually changing the value when you load the dashboard with a prefilled value as the dashboard will treat that as the initial value (and as such, you arent changing it).

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I've tried so many variants of that, but it just seems that the tokens are not evaluated correctly. I've tried about a million variants now 😞

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...