Dashboards & Visualizations

Is there a way to use Splunk multiselect with multiple panels?

barrowvian
Explorer

Hi,

I copied some code used in a previous answer for using multiselect tool. The code would allow the user to show either one panel, the other panel, or both panels. I would like to expand upon this with a third panel in the mix, having the option to show either one panel individually, all panels, or two of the three panels dynamically. I updated the code to add the third panel in there. I'm assuming that Splunk only likes to have one token active for this kind of search? Which is why it worked for one panel, the other panel, or both panels because at any one time only one token will have been active. I'm sure it could be written in a way that would add in a few extra lines to create a few extra token choices, so that only one token would still be active based upon the users choices. However, if it expands to 5,6,7+ panels then that's going to be a lot of logic to write in order to have a token for every possible combination.

Is there a way to do this dynamically so that other panels could be added in future, without having to make a huge number of changes to the logic? Any help would be appreciated, thank you.

<form>
       <label>Vendor Select</label>
        <fieldset submitButton="false">
          <input type="time" token="field1">
            <label></label>
            <default>
              <earliest>-60m@m</earliest>
              <latest>now</latest>
            </default>
          </input>
          <input type="multiselect" token="service_tok" searchWhenChanged="true">
            <label>Select Application</label>
            <choice value="*">All</choice>
            <choice value="show_ansa">ANSA</choice>
            <choice value="show_meta">MetaPost</choice>
            <choice value="show_test3">3rd Test</choice>
            <change>
             <unset token="tokShowAll"></unset>
             <unset token="tokShowAnsa"></unset>
             <unset token="tokShowMeta"></unset>
             <unset token="tokShowTest3"></unset>
            </change>
          </input>
        </fieldset>
        <search>
          <query>
    | makeresults
            | fields - _time
            | eval data="$service_tok$"
            | eval condition=case(match(data,"\*"),
            "show_all",
            match(data,"show_ansa") 
            AND match(data,"show_meta")
            AND match(data,"show_test3"),
            "show_all",
            match(data,"show_ansa"),"show_ansa",
            match(data,"show_meta"),"show_meta",
            match(data,"show_test3"),"show_test3"
            )
            | eval show_all=case(condition="show_all","true")
            | eval show_ansa=case(condition="show_ansa" OR condition="show_all","true")
            | eval show_meta=case(condition="show_meta" OR condition="show_all","true")
            | eval show_test3=case(condition="show_test3" OR condition="show_all","true")

          </query>
          <done>
            <condition match="$job.resultCount$!=0">
             <eval token="tokShowAll">case(isnotnull($result.show_all$),$result.show_all$)</eval>
             <eval token="tokShowAnsa">case(isnotnull($result.show_ansa$),$result.show_ansa$)</eval>
             <eval token="tokShowMeta">case(isnotnull($result.show_meta$),$result.show_meta$)</eval>
             <eval token="tokShowTest3">case(isnotnull($result.show_test3$),$result.show_test3$)</eval>
            </condition>
            <condition>
             <unset token="tokShowAll"></unset>
             <unset token="tokShowAnsa"></unset>
             <unset token="tokShowMeta"></unset>
             <unset token="tokShowTest3"></unset>
            </condition>
          </done>
        </search>
0 Karma
1 Solution

DalJeanis
Legend

Try replacing the search query (lines 27-43) with this...

 <query>
    | makeresults
    | fields - _time
    | eval data="$service_tok$"
    | makemv delim=" " data
    | mvexpand data
    | eval show_ansa=case(data="*","show_all",data="show_ansa",data)
    | eval show_meta=case(data="*","show_all",data="show_meta",data)
    | eval show_test3=case(data="*","show_all",data="show_test3",data)
    | table show_ansa show_meta show_test3
    | stats max(*) as *
  </query>

View solution in original post

0 Karma

DalJeanis
Legend

Try replacing the search query (lines 27-43) with this...

 <query>
    | makeresults
    | fields - _time
    | eval data="$service_tok$"
    | makemv delim=" " data
    | mvexpand data
    | eval show_ansa=case(data="*","show_all",data="show_ansa",data)
    | eval show_meta=case(data="*","show_all",data="show_meta",data)
    | eval show_test3=case(data="*","show_all",data="show_test3",data)
    | table show_ansa show_meta show_test3
    | stats max(*) as *
  </query>
0 Karma

DalJeanis
Legend

I believe the token tokShowAll is redundant. The panels should be controlled each by their own token, so show_all doesn't need one.

0 Karma

barrowvian
Explorer

That has worked perfectly, thank you very much for your help!

DalJeanis
Legend
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...