Dashboards & Visualizations

Show/Hide a table depending on a column value from another table

sdhawanx
Path Finder

I have table with just 2 columns 'Name' and 'Value'. one of the rows has the 'Value' as 'Fail', 'Pass' or 'NA'

I have another table, which has a bunch of related data. I have 2 options for the second table:-

1. I want the query for table 2 to run only when the 'Value' in the first table is 'Fail' and the table 2 to remain hidden

OR

2. but I want that table to be only displayed when the 'Value' in the first table is 'Fail'

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx 

 

Can you please try this xml?

<form>
  <label>Table Depend</label>
  <row>
    <panel>
      <table>
        <title>First Table</title>
        <search>
          <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition match="match($row.val$, &quot;Fail&quot;)">
            <set token="tkn_value">$row.val$</set>
          </condition>
          <condition>
            <unset token="tkn_value" />
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$tkn_value$">
        <title>Second Table with value $tkn_value$</title>
        <search>
          <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

sdhawanx
Path Finder

i added this portion to my simple xml file in the first table

<drilldown>
          <condition match="match($row.val$, &quot;Fail&quot;)">
            <set token="tkn_value">$row.val$</set>
          </condition>
          <condition>
            <unset token="tkn_value" />
          </condition>
</drilldown>

  and then 

 <table depends="$tkn_value$">

 the above portion in the second table. but the second table always remains hidden for some reason no matter what the value is. 

Note:- i changed the row.val as per my table requirement still its the same result. 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx 

 

Is it possible for you to share sample XML of both table.. replace search with dummy search.

0 Karma

sdhawanx
Path Finder

Table 1
<table id="Table_1">
<title>Table 1</title>
<search id="Table_1">
<query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition match="match($row.val$, &quot;Fail&quot;)">
<set token="tkn_value">$row.val$</set>
</condition>
<condition>
<unset token="tkn_value" />
</condition>
</drilldown>
<format type="color" field="Log">
<colorPalette type="list">[#FFFFFF,#DC4E41]</colorPalette>
<scale type="threshold">1</scale>
</format>
</table>

Table 2

<table id="Table_2" depends="$tkn_value$">
<title>Table 2</title>
<search id="base_search_35_1">
<query>
| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$" </query>
</search>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx  Your code looks good and working in my instance also. Anything else you did with table drill down? 

0 Karma

sdhawanx
Path Finder

there is nothing else in the code apart from the changed query 

for the second table i used only this part

| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val 

and removed the last pipe. this is the only difference. But as per my understanding the code should still work fine. but the table remains hidden nonetheless.

i created a sample code on my local splunk and copied your code as is and it seemed to work just fine but when transferring it to the main code its not working

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx 

Can you please check the token value by printing it? Just do below changes.

<drilldown>
    <condition match="match($row.value$, &quot;Fail&quot;)">
      <set token="tkn_value">$row.value$</set>
      <unset token="tkn_value_tmp" />
    </condition>
    <condition>
      <unset token="tkn_value" />
      <set token="tkn_value_tmp">$row.value$ Negative</set>
    </condition>
  </drilldown>

 

Add below

<row>
    <panel>
      <html>$tkn_value$<br />
      $tkn_value_tmp$</html>
    </panel>
  </row>

 

Just observe the behaviour of both token. It will help you to debug more.

 

0 Karma

sdhawanx
Path Finder

I will test this once i return to work. Thanks for the prompt response. Very much appreciated

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!