Dashboards & Visualizations

Open or Close panel based on value of token created in another panel

eyalmanuelharel
Engager

Hello dear Splunkers!

I am struggling with this issue for days and just can't resolve it (ChatGPT is clueless).

I have a panel that displays a trellis pie chart (splitted by a field called MODULE), and the panel has a drilldown that creates the token $module$.

I need to open another panel only if the value inside $module$ equals to "AAA". Otherwise, I need to open a different panel.

For example:

- If I click on the pie chart on the value MODULE="AAA" -> A panel called "ModuleA" is opened.

- If I click on the pie chart on the value MODULE="BBB" (or any other value) ->  A panel called "ModuleOther" is opened.

 

Right now I tried everything I could find on the internet/from the brain/from ChatGPT, but nothing works.

Here's my code for now:

<drilldown>
<condition>
<case match="AAA">
<set token="ModuleA">true</set>
<unset token="ModuleOther"></unset>
</case>
<default>
<unset token="ModuleA"></unset>
<set token="ModuleOther">$trellis.value$</set>
</default>
</condition>
</drilldown>
...
<!-- panel A is opened -->
<panel depends="$ModuleA$">
...
</panel>

<!-- panel Other is opened -->
<panel depends="$ModuleOther$">
...
</panel>

It doesn't work since the tokens don't even contain a value when clicked on the pie.

I even added a text input for each token in order to check if they contain any value when click, and the answer is no.

It's important to emphasize that when I tried to make it a simple drilldown and open one panel when any pie is clicked it worked just fine. The problem is with the conditional tokening.

 

Thank you in advance!!

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

In addition to @ITWhisperer comments, there is an alternative way to set/unset pairs of tokens using the <eval> token mechanism, i.e.

<drilldown>
  <eval token="ModuleA">if($click.value2$="AAA", "true", null())</eval>
  <eval token="ModuleOther">if($click.value2$="AAA", null(), $trellis.value$)</eval>
<drilldown>

I prefer this mechanism over <condition>, where null() is equivalent to unsetting a token. It avoids the &quot; usage and keeps the number of lines down.

Again, click.value2 may not be the right one

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

In addition to @ITWhisperer comments, there is an alternative way to set/unset pairs of tokens using the <eval> token mechanism, i.e.

<drilldown>
  <eval token="ModuleA">if($click.value2$="AAA", "true", null())</eval>
  <eval token="ModuleOther">if($click.value2$="AAA", null(), $trellis.value$)</eval>
<drilldown>

I prefer this mechanism over <condition>, where null() is equivalent to unsetting a token. It avoids the &quot; usage and keeps the number of lines down.

Again, click.value2 may not be the right one

eyalmanuelharel
Engager

Wow, it worked!!

Thank you so much for your kind help.

I can't believe this is so simple and yet no other forum knew what the solution is.

Just a quick clarification, instead of $click.value2$ it should be $trellis.value$ since I used trellis in this panel. I am writing this for future people with the same problem.

Have a great day!

bowesmana
SplunkTrust
SplunkTrust

Just ask the "Men with the Black Fez😁 

bowesmana_0-1735520918598.png

 

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this (I am not sure if you need click.value2, value, name or name2 though, you would need to experiment

<drilldown>
    <condition match="$click.value2$=&quot;AAA&quot;">
        <set token="ModuleA">true</set>
        <unset token="ModuleOther"></unset>
    </condition>
    <condition>
        <unset token="ModuleA"></unset>
        <set token="ModuleOther">$trellis.value$</set>
    </condition>
</drilldown>
...
<!-- panel A is opened -->
<panel depends="$ModuleA$">
    ...
</panel>

<!-- panel Other is opened -->
<panel depends="$ModuleOther$">
    ...
</panel>
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...