Dashboards & Visualizations

Open or Close panel based on value of token created in another panel

eyalmanuelharel
Engager

Hello dear Splunkers!

I am struggling with this issue for days and just can't resolve it (ChatGPT is clueless).

I have a panel that displays a trellis pie chart (splitted by a field called MODULE), and the panel has a drilldown that creates the token $module$.

I need to open another panel only if the value inside $module$ equals to "AAA". Otherwise, I need to open a different panel.

For example:

- If I click on the pie chart on the value MODULE="AAA" -> A panel called "ModuleA" is opened.

- If I click on the pie chart on the value MODULE="BBB" (or any other value) ->  A panel called "ModuleOther" is opened.

 

Right now I tried everything I could find on the internet/from the brain/from ChatGPT, but nothing works.

Here's my code for now:

<drilldown>
<condition>
<case match="AAA">
<set token="ModuleA">true</set>
<unset token="ModuleOther"></unset>
</case>
<default>
<unset token="ModuleA"></unset>
<set token="ModuleOther">$trellis.value$</set>
</default>
</condition>
</drilldown>
...
<!-- panel A is opened -->
<panel depends="$ModuleA$">
...
</panel>

<!-- panel Other is opened -->
<panel depends="$ModuleOther$">
...
</panel>

It doesn't work since the tokens don't even contain a value when clicked on the pie.

I even added a text input for each token in order to check if they contain any value when click, and the answer is no.

It's important to emphasize that when I tried to make it a simple drilldown and open one panel when any pie is clicked it worked just fine. The problem is with the conditional tokening.

 

Thank you in advance!!

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

In addition to @ITWhisperer comments, there is an alternative way to set/unset pairs of tokens using the <eval> token mechanism, i.e.

<drilldown>
  <eval token="ModuleA">if($click.value2$="AAA", "true", null())</eval>
  <eval token="ModuleOther">if($click.value2$="AAA", null(), $trellis.value$)</eval>
<drilldown>

I prefer this mechanism over <condition>, where null() is equivalent to unsetting a token. It avoids the &quot; usage and keeps the number of lines down.

Again, click.value2 may not be the right one

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

In addition to @ITWhisperer comments, there is an alternative way to set/unset pairs of tokens using the <eval> token mechanism, i.e.

<drilldown>
  <eval token="ModuleA">if($click.value2$="AAA", "true", null())</eval>
  <eval token="ModuleOther">if($click.value2$="AAA", null(), $trellis.value$)</eval>
<drilldown>

I prefer this mechanism over <condition>, where null() is equivalent to unsetting a token. It avoids the &quot; usage and keeps the number of lines down.

Again, click.value2 may not be the right one

eyalmanuelharel
Engager

Wow, it worked!!

Thank you so much for your kind help.

I can't believe this is so simple and yet no other forum knew what the solution is.

Just a quick clarification, instead of $click.value2$ it should be $trellis.value$ since I used trellis in this panel. I am writing this for future people with the same problem.

Have a great day!

bowesmana
SplunkTrust
SplunkTrust

Just ask the "Men with the Black Fez😁 

bowesmana_0-1735520918598.png

 

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this (I am not sure if you need click.value2, value, name or name2 though, you would need to experiment

<drilldown>
    <condition match="$click.value2$=&quot;AAA&quot;">
        <set token="ModuleA">true</set>
        <unset token="ModuleOther"></unset>
    </condition>
    <condition>
        <unset token="ModuleA"></unset>
        <set token="ModuleOther">$trellis.value$</set>
    </condition>
</drilldown>
...
<!-- panel A is opened -->
<panel depends="$ModuleA$">
    ...
</panel>

<!-- panel Other is opened -->
<panel depends="$ModuleOther$">
    ...
</panel>
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...