Is it possible to create a dashboard with buttons to disable and enable panels?

[EricWehrly]

We have some dashboards that are kind of busy. As a reaction to how cumbersome they are, I wound up creating some duplicate dashboards with cherry picked panels for specific information. However, we sometimes wind up having to switch between them, which can be fairly time consuming when they bump up against user search limitations and can only be open one at a time. It would be nice to be able to have a dashboard that shows all the various data points of information, and have buttons on it to toggle individual panels on and off.

I saw this answer:
https://answers.splunk.com/answers/208476/how-to-enable-or-disable-dashboard-panels-based-on.html
and while that would work, it would make maintaining the dashboard a little difficult, and it's not really great UX. If it's at all possible to add a little toggle down with the inspect / export / refresh buttons, that would be awesome. Any chance of this?

[somesoni2]

See if something like this work for your (run anywhere sample dashboard). It basically adds a checkbox in each panel/row, and panel search will not run and panel will not shown unless the checkbox is checked.

<form>
  <label>TestTogglePanel</label>
  <row>
    <panel>
      <input type="checkbox" token="panel1">
        <label></label>
        <choice value="*">Show This Panel</choice>
      </input>
      <table depends="$panel1$">
        <title>Count by source</title>
        <search>
          <query>index=_internal sourcetypye=splunkd host=sk* earliest=-5m@m $panel1$| stats count by source</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <input type="checkbox" token="panel2">
        <label></label>
        <choice value="*">Show This Panel</choice>
      </input>
      <table depends="$panel2$">
        <title>Count by sourcetype</title>
        <search>
          <query>index=_internal sourcetypye=splunkd host=sk* earliest=-5m@m $panel2$| stats count by sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

[EricWehrly]

Unfortunately I don't think that this accomplishes the desired result. Looking at the network traffic for the tab, there's still data being passed for a dashboard with all of the widgets disabled. Based on that, I'd think this is doing show / hide rather than enable / disable, so it doesn't really accomplish the goal of toggling which dashboard widgets run in order to reduce user search consumption.

[rjthibod]

You could try refining @somesoni2 suggestion by setting the tokens to the actual search to be performed. For example changing the inputs and search queries in the following way

 <form>
   <label>TestTogglePanel</label>
   <row>
     <panel>
       <input type="checkbox" token="panel1">
         <label></label>
         <choice value="index=_internal sourcetype=splunkd host=sk*">Show This Panel</choice>
       </input>
       <table depends="$panel1$">
         <title>Count by source</title>
         <search>
           <query>$panel1$ | stats count by source</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">false</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="count">10</option>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <input type="checkbox" token="panel2">
         <label></label>
         <choice value="index=_internal sourcetype=splunkd host=sk*">Show This Panel</choice>
       </input>
       <table depends="$panel2$">
         <title>Count by sourcetype</title>
         <search>
           <query>$panel2$ | stats count by sourcetype</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
       </table>
     </panel>
   </row>
 </form>

[EricWehrly]

The queries that I have use variables from input objects at the top of the form.
I'm having trouble figuring out how to inject the input values into the choice value.

[rjthibod]

You can't really. You would have to break up the choice value and those input values into to two separate tokens that you pass into the search.

[somesoni2]

What version of Splunk are you using?

[EricWehrly]

Splunk cloud. Looks like 6.4.1.2.