Dashboards & Visualizations
Highlighted

If else condition for dashboard

Contributor

How can I do an if token=something then run this query for the panel and else to run another query for that same panel?
So I have the following query:

query 1:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "Name" = substr(Name,1,3)
| eval "Name" = upper(Name)
| rex field=Name mode=sed "s/AAA/APAC/g"
| rex field=Name mode=sed "s/ABC/ABCD3/g"
| rex field=Name mode=sed "s/CDF/CDF123/g"
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voicecount"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video
count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voicecount") as AvgVoice, avg("Videocount") as AvgVideo, sum("Voicecount") as SumVoice, sum("Videocount") as SumVideo by Name

query2:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "transporttype"=replace('Transport Type',"\"","") | eval "Voicecount"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video
count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voicecount") as AvgVoice, avg("Videocount") as AvgVideo, sum("Voicecount") as SumVoice, sum("Videocount") as SumVideo by Name

How can I make my dashboard panel to run query 1 if the token value is "All", and if else for query 2, else for maybe other query? Can I do this with splunk?
Thanks

Highlighted

Re: If else condition for dashboard

SplunkTrust
SplunkTrust

Put both panels in the same place, and set a token for depends in one, and for rejects in the other. When the token exists, the depends panel will show, when the token does NOT exist, then the rejects panel will show.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML

Highlighted

Re: If else condition for dashboard

Super Champion

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-o...
this is a blog post for help on it.

View solution in original post

Highlighted

Re: If else condition for dashboard

SplunkTrust
SplunkTrust

You can also use <condition label="YOUR_CHOICE_LABEL"> which is good for when you have a choice of "All" with value of "*".

0 Karma