Dashboards & Visualizations

If else condition for dashboard

Contributor

How can I do an if token=something then run this query for the panel and else to run another query for that same panel?
So I have the following query:

query 1:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "Name" = substr(Name,1,3)
| eval "Name" = upper(Name)
| rex field=Name mode=sed "s/AAA/APAC/g"
| rex field=Name mode=sed "s/ABC/ABCD3/g"
| rex field=Name mode=sed "s/CDF/CDF123/g"
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

query2:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

How can I make my dashboard panel to run query 1 if the token value is "All", and if else for query 2, else for maybe other query? Can I do this with splunk?
Thanks

1 Solution

Super Champion

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-o...
this is a blog post for help on it.

View solution in original post

Super Champion

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-o...
this is a blog post for help on it.

View solution in original post

SplunkTrust
SplunkTrust

You can also use <condition label="YOUR_CHOICE_LABEL"> which is good for when you have a choice of "All" with value of "*".

0 Karma

SplunkTrust
SplunkTrust

Put both panels in the same place, and set a token for depends in one, and for rejects in the other. When the token exists, the depends panel will show, when the token does NOT exist, then the rejects panel will show.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!