Dashboards & Visualizations

Show/Hide Panels based off time range picker

mdeterville
Path Finder

Hi There:

I'd like to set up some panels that show/hide based on the values of the  date/time range picker.

Two different panels:

1. Show only when time range picker is set to <=30 days

2. Show only when time range picker is set to >30 days

I've tested a few "depends" set ups with no luck.

Any help would be greatly appreciated. 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Can you show what you've tried. 

Here's an example that shows how it can be done. If you select a time range > 30 days, then it shows one panel or < 30 days, the other one.

<form>
  <label>Depends</label>
  <fieldset submitButton="false">
    <input type="time" token="time_range">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.x$==&quot;1&quot;">
              <set token="show"></set>
            </condition>
            <condition match="$result.x$==&quot;0&quot;">
              <unset token="show"></unset>
            </condition>
          </done>
          <query>| makeresults
| eval earliest=relative_time(now(),$time_range.earliest|s$)
| eval latest=if($time_range.latest|s$="now", now(), relative_time(now(),$time_range.latest|s$))
| eval diff=latest-earliest
| eval x=if(diff &gt; (86400*30),1,0)</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$show$">
      <table>
        <search>
          <query>| makeresults
            | eval Message="This panel is now showing because time range span is more than 30 days"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel rejects="$show$">
      <table>
        <search>
          <query>| makeresults
            | eval Message="This panel is now showing because time range span is less than 30 days"</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Hope this helps

 

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...