Dashboards & Visualizations

Is it possible to create a dashboard with buttons to disable and enable panels?

EricWehrly
Engager

We have some dashboards that are kind of busy. As a reaction to how cumbersome they are, I wound up creating some duplicate dashboards with cherry picked panels for specific information. However, we sometimes wind up having to switch between them, which can be fairly time consuming when they bump up against user search limitations and can only be open one at a time. It would be nice to be able to have a dashboard that shows all the various data points of information, and have buttons on it to toggle individual panels on and off.

I saw this answer:
https://answers.splunk.com/answers/208476/how-to-enable-or-disable-dashboard-panels-based-on.html
and while that would work, it would make maintaining the dashboard a little difficult, and it's not really great UX. If it's at all possible to add a little toggle down with the inspect / export / refresh buttons, that would be awesome. Any chance of this?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

See if something like this work for your (run anywhere sample dashboard). It basically adds a checkbox in each panel/row, and panel search will not run and panel will not shown unless the checkbox is checked.

<form>
  <label>TestTogglePanel</label>
  <row>
    <panel>
      <input type="checkbox" token="panel1">
        <label></label>
        <choice value="*">Show This Panel</choice>
      </input>
      <table depends="$panel1$">
        <title>Count by source</title>
        <search>
          <query>index=_internal sourcetypye=splunkd host=sk* earliest=-5m@m $panel1$| stats count by source</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <input type="checkbox" token="panel2">
        <label></label>
        <choice value="*">Show This Panel</choice>
      </input>
      <table depends="$panel2$">
        <title>Count by sourcetype</title>
        <search>
          <query>index=_internal sourcetypye=splunkd host=sk* earliest=-5m@m $panel2$| stats count by sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

EricWehrly
Engager

Unfortunately I don't think that this accomplishes the desired result. Looking at the network traffic for the tab, there's still data being passed for a dashboard with all of the widgets disabled. Based on that, I'd think this is doing show / hide rather than enable / disable, so it doesn't really accomplish the goal of toggling which dashboard widgets run in order to reduce user search consumption.

0 Karma

rjthibod
Champion

You could try refining @somesoni2 suggestion by setting the tokens to the actual search to be performed. For example changing the inputs and search queries in the following way

 <form>
   <label>TestTogglePanel</label>
   <row>
     <panel>
       <input type="checkbox" token="panel1">
         <label></label>
         <choice value="index=_internal sourcetype=splunkd host=sk*">Show This Panel</choice>
       </input>
       <table depends="$panel1$">
         <title>Count by source</title>
         <search>
           <query>$panel1$ | stats count by source</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">false</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="count">10</option>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <input type="checkbox" token="panel2">
         <label></label>
         <choice value="index=_internal sourcetype=splunkd host=sk*">Show This Panel</choice>
       </input>
       <table depends="$panel2$">
         <title>Count by sourcetype</title>
         <search>
           <query>$panel2$ | stats count by sourcetype</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
       </table>
     </panel>
   </row>
 </form>
0 Karma

EricWehrly
Engager

The queries that I have use variables from input objects at the top of the form.
I'm having trouble figuring out how to inject the input values into the choice value.

0 Karma

rjthibod
Champion

You can't really. You would have to break up the choice value and those input values into to two separate tokens that you pass into the search.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What version of Splunk are you using?

0 Karma

EricWehrly
Engager

Splunk cloud. Looks like 6.4.1.2.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...