If else condition for dashboard

[tamduong16]

How can I do an if token=something then run this query for the panel and else to run another query for that same panel?
So I have the following query:

query 1:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "Name" = substr(Name,1,3)
| eval "Name" = upper(Name)
| rex field=Name mode=sed "s/AAA/APAC/g"
| rex field=Name mode=sed "s/ABC/ABCD3/g"
| rex field=Name mode=sed "s/CDF/CDF123/g"
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

query2:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

How can I make my dashboard panel to run query 1 if the token value is "All", and if else for query 2, else for maybe other query? Can I do this with splunk?
Thanks

[cmerriman · Accepted solution]

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-o...
this is a blog post for help on it.

[jkat54]

You can also use <condition label="YOUR_CHOICE_LABEL"> which is good for when you have a choice of "All" with value of "*".

[DalJeanis]

Put both panels in the same place, and set a token for depends in one, and for rejects in the other. When the token exists, the depends panel will show, when the token does NOT exist, then the rejects panel will show.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML